theory Ipc_R

lemma receiveIPC_corres:
  assumes "is_ep_cap cap" and "cap_relation cap cap'"
  shows "
   corres dc (einvs and valid_sched and tcb_at thread and valid_cap cap and ex_nonz_cap_to thread
              and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3))
             (invs' and tcb_at' thread and valid_cap' cap')
             (receive_ipc thread cap isBlocking) (receiveIPC thread cap' isBlocking)" apply (insert assms) apply (simp add: receive_ipc_def receiveIPC_def
              split del: if_split) apply (case_tac cap, simp_all add: isEndpointCap_def) apply (rename_tac word1 word2 right) apply clarsimp apply (rule corres_guard_imp) apply (rule corres_split[OF getEndpoint_corres]) apply (rule corres_guard_imp) apply (rule corres_split[OF getBoundNotification_corres]) apply (rule_tac r'="ntfn_relation" in corres_split) apply (rule corres_option_split[rotated 2]) apply (rule getNotification_corres) apply clarsimp apply (rule corres_trivial, simp add: ntfn_relation_def default_notification_def
                                                   default_ntfn_def) apply (rule corres_if) apply (clarsimp simp: ntfn_relation_def Ipc_A.isActive_def Endpoint_H.isActive_def
                             split: Structures_A.ntfn.splits Structures_H.notification.splits) apply clarsimp apply (rule completeSignal_corres) apply (rule_tac P="einvs and valid_sched and tcb_at thread and
                                      ep_at word1 and valid_ep ep and
                                      obj_at (\<lambda>k. k = Endpoint ep) word1
                                      and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)
                                      and ex_nonz_cap_to thread" and
                                P'="invs' and tcb_at' thread and ep_at' word1 and
                                          valid_ep' epa"
                                in corres_inst) apply (case_tac ep)
              \<comment> \<open>IdleEP\<close> apply (simp add: ep_relation_def) apply (rule corres_guard_imp) apply (case_tac isBlocking; simp) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule setEndpoint_corres) apply (simp add: ep_relation_def) apply wp+ apply (rule corres_guard_imp, rule doNBRecvFailedTransfer_corres, simp) apply simp apply (clarsimp simp add: invs_def valid_state_def valid_pspace_def
              valid_tcb_state_def st_tcb_at_tcb_at) apply auto[1]
             \<comment> \<open>SendEP\<close> apply (simp add: ep_relation_def) apply (rename_tac list) apply (rule_tac F="list \<noteq> []" in corres_req) apply (clarsimp simp: valid_ep_def) apply (case_tac list, simp_all split del: if_split)[1] apply (rule corres_guard_imp) apply (rule corres_split[OF setEndpoint_corres]) apply (case_tac lista, simp_all add: ep_relation_def)[1] apply (rule corres_split[OF getThreadState_corres]) apply (rule_tac
                            F="\<exists>data.
                                sender_state =
                                Structures_A.thread_state.BlockedOnSend word1 data"
                            in corres_gen_asm) apply (clarsimp simp: isSend_def case_bool_If
                                         case_option_If if3_fold
                              split del: if_split cong: if_cong) apply (rule corres_split[OF doIPCTransfer_corres]) apply (simp split del: if_split cong: if_cong) apply (fold dc_def)[1] apply (rule_tac P="valid_objs and valid_mdb and valid_list
                                             and valid_sched
                                             and cur_tcb
                                             and valid_reply_caps
                                             and pspace_aligned and pspace_distinct
                                             and st_tcb_at (Not \<circ> awaiting_reply) a
                                             and st_tcb_at (Not \<circ> halted) a
                                             and tcb_at thread and valid_reply_masters
                                             and cte_wp_at (\<lambda>c. c = cap.NullCap)
                                                           (thread, tcb_cnode_index 3)"
                                 and P'="tcb_at' a and tcb_at' thread and cur_tcb'
                                                   and Invariants_H.valid_queues
                                                   and valid_queues'
                                                   and valid_pspace'
                                                   and valid_objs'
                                             and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)"
                                  in corres_guard_imp [OF corres_if]) apply (simp add: fault_rel_optionation_def) apply (rule corres_if2 [OF _ setupCallerCap_corres setThreadState_corres]) apply simp apply simp apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule possibleSwitchTo_corres) apply (wp sts_st_tcb_at' set_thread_state_runnable_weak_valid_sched_action
                             | simp)+ apply (wp sts_st_tcb_at'_cases sts_valid_queues setThreadState_valid_queues'
                                 setThreadState_st_tcb
                            | simp)+ apply (clarsimp simp: st_tcb_at_tcb_at st_tcb_def2 valid_sched_def
                                            valid_sched_action_def) apply (clarsimp split: if_split_asm) apply (clarsimp | wp do_ipc_transfer_tcb_caps)+ apply (rule_tac Q="\<lambda>_ s. sch_act_wf (ksSchedulerAction s) s"
                         in hoare_post_imp, erule sch_act_wf_weak) apply (wp sts_st_tcb' gts_st_tcb_at | simp)+ apply (simp cong: list.case_cong) apply wp apply simp apply (wp weak_sch_act_wf_lift_linear setEndpoint_valid_mdb' set_ep_valid_objs') apply (clarsimp split: list.split) apply (clarsimp simp add: invs_def valid_state_def st_tcb_at_tcb_at) apply (clarsimp simp add: valid_ep_def valid_pspace_def) apply (drule(1) sym_refs_obj_atD[where P="\<lambda>ko. ko = Endpoint e" for e]) apply (fastforce simp: st_tcb_at_refs_of_rev elim: st_tcb_weakenE) apply (auto simp: valid_ep'_def invs'_def valid_state'_def split: list.split)[1]
            \<comment> \<open>RecvEP\<close> apply (simp add: ep_relation_def) apply (rule_tac corres_guard_imp) apply (case_tac isBlocking; simp) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule setEndpoint_corres) apply (simp add: ep_relation_def) apply wp+ apply (rule corres_guard_imp, rule doNBRecvFailedTransfer_corres, simp) apply simp apply (clarsimp simp: valid_tcb_state_def) apply (clarsimp simp add: valid_tcb_state'_def) apply (wp get_simple_ko_wp[where f=Notification] getNotification_wp gbn_wp gbn_wp'
                      hoare_vcg_all_lift hoare_vcg_imp_lift hoare_vcg_if_lift
                    | wpc | simp add: ep_at_def2[symmetric, simplified] | clarsimp)+ apply (clarsimp simp: valid_cap_def invs_psp_aligned invs_valid_objs pred_tcb_at_def
                         valid_obj_def valid_tcb_def valid_bound_ntfn_def
                  dest!: invs_valid_objs
                  elim!: obj_at_valid_objsE
                  split: option.splits) apply (auto simp: valid_cap'_def invs_valid_pspace' valid_obj'_def valid_tcb'_def
                    valid_bound_ntfn'_def obj_at'_def projectKOs pred_tcb_at'_def
             dest!: invs_valid_objs' obj_at_valid_objs'
             split: option.splits) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (einvs and valid_sched and tcb_at thread and valid_cap cap and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' cap') (receive_ipc thread cap isBlocking) (receiveIPC thread cap' isBlocking) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_ep_cap cap; cap_relation cap cap'\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and valid_cap cap and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' cap') (receive_ipc thread cap isBlocking) (receiveIPC thread cap' isBlocking) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_ep_cap cap; cap_relation cap cap'\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and valid_cap cap and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' cap') (do (epptr, rights) <- case cap of cap.EndpointCap ref badge rights \<Rightarrow> return (ref, rights) | _ \<Rightarrow> fail;
ep <- get_endpoint epptr;
ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive epptr \<lparr>receiver_can_grant = AllowGrant \<in> rights\<rparr>);
set_endpoint epptr (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint epptr $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref data \<Rightarrow> return data | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some epptr) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> rights) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive epptr \<lparr>receiver_can_grant = AllowGrant \<in> rights\<rparr>);
set_endpoint epptr (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (if isEndpointCap cap' then do ep <- getEndpoint (capEPPtr cap');
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap') $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap')) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap') | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od else fail) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33. \<lbrakk>cap' = capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33); cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and valid_cap (cap.EndpointCap x31 x32 x33) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap x31 x32 (AllowWrite \<in> x33) (AllowRead \<in> x33) (AllowGrant \<in> x33) (AllowGrantReply \<in> x33))) (do ep <- get_endpoint x31;
ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive x31 \<lparr>receiver_can_grant = AllowGrant \<in> x33\<rparr>);
set_endpoint x31 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint x31 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some x31) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> x33) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive x31 \<lparr>receiver_can_grant = AllowGrant \<in> x33\<rparr>);
set_endpoint x31 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ep <- getEndpoint x31;
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap') $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap')) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap') | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 word2 right. \<lbrakk>cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); cap = cap.EndpointCap word1 word2 right\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (do ep <- get_endpoint word1;
ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ep <- getEndpoint word1;
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap') (capEPCanGrant cap')) thread;
setEndpoint (capEPPtr cap') $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap') $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap')) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case (call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap sender thread (capEPCanGrant cap') | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | (False, xa) \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (do ep <- get_endpoint word1;
ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ep <- getEndpoint word1;
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od) proof (prove)
goal (3 subgoals):
 1. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> corres dc (?Q19 word1 word2 right) (?Q'19 word1 word2 right) (do ep <- get_endpoint word1;
ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ep <- getEndpoint word1;
ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od)
 2. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> ?Q19 word1 word2 right s
 3. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> ?Q'19 word1 word2 right s proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> corres dc (?R23 word1 word2 right ep) (?R'23 word1 word2 right epa) (do ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od)
 2. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 3. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 4. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
 5. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'23 word1 word2 right) s proof (prove)
goal (7 subgoals):
 1. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> corres dc (?Q28 word1 word2 right ep epa) (?Q'28 word1 word2 right ep epa) (do ntfnptr <- get_bound_notification thread;
ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ntfnPtr <- getBoundNotification thread;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od)
 2. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> ?Q28 word1 word2 right ep epa s
 3. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> ?Q'28 word1 word2 right ep epa s
 4. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 5. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 6. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
 7. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'23 word1 word2 right) s proof (prove)
goal (9 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> corres dc (?R32 word1 word2 right ep epa ntfnptr) (?R'32 word1 word2 right ep epa ntfnPtr) (do ntfn <- case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x;
if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive ntfn then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread
od) (do ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od)
 2. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>?R32 word1 word2 right ep epa\<rbrace>
 3. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>?R'32 word1 word2 right ep epa\<rbrace>
 4. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 5. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 6. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 7. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 8. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
 9. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'23 word1 word2 right) s proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> corres ntfn_relation (?P38 word1 word2 right ep epa ntfnptr) (?P'40 word1 word2 right ep epa ntfnPtr) (case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x) (case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R37 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?R'37 word1 word2 right ep epa ntfnptr ntfnPtr rv') (if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?R37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?R'37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. ?P38 word1 word2 right ep epa ntfnptr and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. ?P'40 word1 word2 right ep epa ntfnPtr and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr x. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfnptr = Some x\<rbrakk> \<Longrightarrow> corres ntfn_relation (?Q44 word1 word2 right ep epa ntfnptr x) (?Q'47 word1 word2 right ep epa ntfnPtr x) (get_notification x) (getNotification x)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> ntfnptr = ntfnPtr
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> corres ntfn_relation (?P43 word1 word2 right ep epa ntfnptr) (?P'46 word1 word2 right ep epa ntfnPtr) (return default_notification) (return (NTFN Structures_H.ntfn.IdleNtfn None))
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R37 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?R'37 word1 word2 right ep epa ntfnptr ntfnPtr rv') (if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?R37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?R'37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> ?P43 word1 word2 right ep epa ntfnptr | Some x \<Rightarrow> ?Q44 word1 word2 right ep epa ntfnptr x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> ?P'46 word1 word2 right ep epa ntfnPtr | Some x \<Rightarrow> ?Q'47 word1 word2 right ep epa ntfnPtr x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> ntfnptr = ntfnPtr
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> corres ntfn_relation (?P43 word1 word2 right ep epa ntfnptr) (?P'46 word1 word2 right ep epa ntfnPtr) (return default_notification) (return (NTFN Structures_H.ntfn.IdleNtfn None))
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R37 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?R'37 word1 word2 right ep epa ntfnptr ntfnPtr rv') (if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?R37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?R'37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> ?P43 word1 word2 right ep epa ntfnptr | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> ?P'46 word1 word2 right ep epa ntfnPtr | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> corres ntfn_relation (?P43 word1 word2 right ep epa ntfnptr) (?P'46 word1 word2 right ep epa ntfnPtr) (return default_notification) (return (NTFN Structures_H.ntfn.IdleNtfn None))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R37 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?R'37 word1 word2 right ep epa ntfnptr ntfnPtr rv') (if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?R37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?R'37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> ?P43 word1 word2 right ep epa ntfnptr | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> ?P'46 word1 word2 right ep epa ntfnPtr | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R37 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?R'37 word1 word2 right ep epa ntfnptr ntfnPtr rv') (if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then complete_signal (the ntfnptr) thread else case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then completeSignal (the ntfnPtr) thread else case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>?R37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?R'37 word1 word2 right ep epa ntfnptr ntfnPtr\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv) = ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv')
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P59 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?P'62 word1 word2 right ep epa ntfnptr ntfnPtr rv') (complete_signal (the ntfnptr) thread) (completeSignal (the ntfnPtr) thread)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv') (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ?P59 word1 word2 right ep epa ntfnptr ntfnPtr rv else ?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ?P'62 word1 word2 right ep epa ntfnptr ntfnPtr rv' else ?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv'\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P59 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?P'62 word1 word2 right ep epa ntfnptr ntfnPtr rv') (complete_signal (the ntfnptr) thread) (completeSignal (the ntfnPtr) thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv') (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ?P59 word1 word2 right ep epa ntfnptr ntfnPtr rv else ?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ?P'62 word1 word2 right ep epa ntfnptr ntfnPtr rv' else ?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv'\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P59 word1 word2 right ep epa ntfnPtr ntfnPtr rv) (?P'62 word1 word2 right ep epa ntfnPtr ntfnPtr rv') (complete_signal (the ntfnPtr) thread) (completeSignal (the ntfnPtr) thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv') (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ?P59 word1 word2 right ep epa ntfnptr ntfnPtr rv else ?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ?P'62 word1 word2 right ep epa ntfnptr ntfnPtr rv' else ?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv'\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv) (?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv') (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else ?Q60 word1 word2 right ep epa ntfnptr ntfnPtr rv\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else ?Q'63 word1 word2 right ep epa ntfnptr ntfnPtr rv'\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) (case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP\<rbrakk> \<Longrightarrow> corres dc (?Q141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') (?Q'141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') (case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> ?Q141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> ?Q'141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> corres dc (?Q141 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (?Q'141 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do y <- set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread;
setEndpoint word1 (Structures_H.endpoint.RecvEP [thread])
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (?Q141 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (?Q'141 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> ?Q141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> ?Q'141 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
A total of 16 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> thread_state_relation (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' y) (?R'152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' ya) (set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])) (setEndpoint word1 (Structures_H.endpoint.RecvEP [thread]))
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>?R152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv'\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>?R'152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv'\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (tcb_at' thread and ?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q158 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'156 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' y) (?R'152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' ya) (set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])) (setEndpoint word1 (Structures_H.endpoint.RecvEP [thread]))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>?R152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv'\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>?R'152 word1 word2 right ep epa ntfnptr ntfnPtr rv rv'\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (tcb_at' thread and ?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q158 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'156 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.RecvEP [thread]) (Structures_H.endpoint.RecvEP [thread])
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>\<lambda>y. ep_at word1\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>\<lambda>ya. ep_at' word1\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (tcb_at' thread and ?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q158 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'156 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>\<lambda>y. ep_at word1\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv'\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>\<lambda>ya. ep_at' word1\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q158 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (tcb_at' thread and ?Q'156 word1 word2 right Structures_A.endpoint.IdleEP Structures_H.endpoint.IdleEP ntfnPtr ntfnPtr rv rv') (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q158 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'156 word1 word2 right ep epa ntfnptr ntfnPtr rv rv') s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ep_at word1) (tcb_at' thread and ep_at' word1) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; \<not> isBlocking; (tcb_at' thread and ep_at' word1) s\<rbrakk> \<Longrightarrow> tcb_at' thread s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (einvs and tcb_at thread and ep_at word1 and valid_ep Structures_A.endpoint.IdleEP and obj_at (\<lambda>k. k = Endpoint Structures_A.endpoint.IdleEP) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.IdleEP; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.IdleEP; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' Structures_H.endpoint.IdleEP) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x2. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP x2; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP x2\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP x2) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP x2)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP x2)) (do y <- assert (x2 \<noteq> []);
y <- set_endpoint word1 (case drop (Suc 0) x2 of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) x2));
sender_state <- get_thread_state (hd x2);
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer (hd x2) (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap (hd x2) thread (AllowGrant \<in> right) else set_thread_state (hd x2) Structures_A.thread_state.Inactive else do y <- set_thread_state (hd x2) Structures_A.thread_state.Running;
possible_switch_to (hd x2)
od
od) (case x2 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP list; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP list\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP list)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP list)) (do y <- assert (list \<noteq> []);
y <- set_endpoint word1 (case drop (Suc 0) list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list));
sender_state <- get_thread_state (hd list);
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer (hd list) (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap (hd list) thread (AllowGrant \<in> right) else set_thread_state (hd list) Structures_A.thread_state.Inactive else do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
possible_switch_to (hd list)
od
od) (case list of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list s s'. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP list; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP list; (s, s') \<in> state_relation; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP list)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP list)) s'\<rbrakk> \<Longrightarrow> list \<noteq> []
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP list; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP list)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP list)) (do y <- assert (list \<noteq> []);
y <- set_endpoint word1 (case drop (Suc 0) list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list));
sender_state <- get_thread_state (hd list);
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer (hd list) (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap (hd list) thread (AllowGrant \<in> right) else set_thread_state (hd list) Structures_A.thread_state.Inactive else do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
possible_switch_to (hd list)
od
od) (case list of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP list; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP list; list \<noteq> []\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP list) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP list)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP list)) (do y <- assert (list \<noteq> []);
y <- set_endpoint word1 (case drop (Suc 0) list of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list));
sender_state <- get_thread_state (hd list);
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer (hd list) (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap (hd list) thread (AllowGrant \<in> right) else set_thread_state (hd list) Structures_A.thread_state.Inactive else do y <- set_thread_state (hd list) Structures_A.thread_state.Running;
possible_switch_to (hd list)
od
od) (case list of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) (do y <- set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list));
sender_state <- get_thread_state a;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do y <- setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista);
senderState <- getThreadState a;
y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> corres dc (?Q185 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) (?Q'185 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) (do y <- set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list));
sender_state <- get_thread_state a;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do y <- setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista);
senderState <- getThreadState a;
y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> ?Q185 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> ?Q'185 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> ep_relation (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y) (?R'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya) (do sender_state <- get_thread_state a;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do senderState <- getThreadState a;
y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>?R189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>?R'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y) (?R'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya) (do sender_state <- get_thread_state a;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do senderState <- getThreadState a;
y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>?R189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>?R'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state senderState. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya; thread_state_relation sender_state senderState\<rbrakk> \<Longrightarrow> corres dc (?R198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state) (?R'198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya senderState) (do data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>?R198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>?R'198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state senderState. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya; thread_state_relation sender_state senderState; \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data\<rbrakk> \<Longrightarrow> corres dc (?P208 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state) (?R'198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya senderState) (do data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do y <- assert (isSend senderState);
y <- doIPCTransfer a (Some word1) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) thread;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. ?P208 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>?R'198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P208 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)) (?R'198 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))) (do y <- do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od
od) (do y <- doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a else do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. ?P208 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>?R'198 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R225 word1 word2 right ntfnPtr rv rv' a lista data y) (?R'225 word1 word2 right ntfnPtr rv rv' a lista data ya) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a else do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R'225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R225 word1 word2 right ntfnPtr rv rv' a lista data ()) (?R'225 word1 word2 right ntfnPtr rv rv' a lista data ()) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a else do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R'225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R225 word1 word2 right ntfnPtr rv rv' a lista data ()) (?R'225 word1 word2 right ntfnPtr rv rv' a lista data ()) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive else do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a else do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>?R'225 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
A total of 20 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> sender_is_call data = sender_is_call data
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P237 word1 word2 right ntfnPtr rv rv' a lista data) (?P'237 word1 word2 right ntfnPtr rv rv' a lista data) (if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive) (if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a)
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q237 word1 word2 right ntfnPtr rv rv' a lista data) (?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then ?P237 word1 word2 right ntfnPtr rv rv' a lista data else ?Q237 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then ?P'237 word1 word2 right ntfnPtr rv rv' a lista data else ?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) s
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 7. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?P237 word1 word2 right ntfnPtr rv rv' a lista data) (?P'237 word1 word2 right ntfnPtr rv rv' a lista data) (if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap a thread (AllowGrant \<in> right) else set_thread_state a Structures_A.thread_state.Inactive) (if sender_can_grant data \<or> sender_can_grant_reply data then setupCallerCap a thread (AllowGrant \<in> right) else setThreadState Structures_H.thread_state.Inactive a)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q237 word1 word2 right ntfnPtr rv rv' a lista data) (?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then ?P237 word1 word2 right ntfnPtr rv rv' a lista data else ?Q237 word1 word2 right ntfnPtr rv rv' a lista data) s
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then ?P'237 word1 word2 right ntfnPtr rv rv' a lista data else ?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> (sender_can_grant data \<or> sender_can_grant_reply data) = (sender_can_grant data \<or> sender_can_grant_reply data)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; \<not> (sender_can_grant data \<or> sender_can_grant_reply data)\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q237 word1 word2 right ntfnPtr rv rv' a lista data) (?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else ?Q237 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else ?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) s
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 7. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; \<not> (sender_can_grant data \<or> sender_can_grant_reply data)\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Inactive Structures_H.thread_state.Inactive
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q237 word1 word2 right ntfnPtr rv rv' a lista data) (?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else ?Q237 word1 word2 right ntfnPtr rv rv' a lista data) s
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else ?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?Q237 word1 word2 right ntfnPtr rv rv' a lista data) (?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) (do y <- set_thread_state a Structures_A.thread_state.Running;
possible_switch_to a
od) (do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else ?Q237 word1 word2 right ntfnPtr rv rv' a lista data) s
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else ?Q'237 word1 word2 right ntfnPtr rv rv' a lista data) s
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
A total of 22 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data rva rv'a. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R244 word1 word2 right ntfnPtr rv rv' a lista data rva) (?R'244 word1 word2 right ntfnPtr rv rv' a lista data rv'a) (possible_switch_to a) (possibleSwitchTo a)
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else tcb_at a and ?Q244 word1 word2 right ntfnPtr rv rv' a lista data) s
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and ?Q'244 word1 word2 right ntfnPtr rv rv' a lista data) s
 7. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 8. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data rva rv'a. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (?R244 word1 word2 right ntfnPtr rv rv' a lista data rva) (?R'244 word1 word2 right ntfnPtr rv rv' a lista data rv'a) (possible_switch_to a) (possibleSwitchTo a)
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>?R244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>?R'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace>
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else tcb_at a and ?Q244 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and ?Q'244 word1 word2 right ntfnPtr rv rv' a lista data) s
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 7. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> set_thread_state a Structures_A.thread_state.Running \<lbrace>\<lambda>rva. valid_etcbs and weak_valid_sched_action and cur_tcb and st_tcb_at runnable a\<rbrace>
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'a. Invariants_H.valid_queues and valid_queues' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and cur_tcb' and tcb_at' a and st_tcb_at' runnable' a and valid_objs'\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else tcb_at a and ?Q244 word1 word2 right ntfnPtr rv rv' a lista data) s
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and ?Q'244 word1 word2 right ntfnPtr rv rv' a lista data) s
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 6. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'244 word1 word2 right ntfnPtr rv rv' a lista data\<rbrace> setThreadState Structures_H.thread_state.Running a \<lbrace>\<lambda>rv'a s. Invariants_H.valid_queues s \<and> valid_queues' s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> cur_tcb' s \<and> tcb_at' a s \<and> st_tcb_at' runnable' a s \<and> valid_objs' s\<rbrace>
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then st_tcb_at (Not \<circ> halted) a and tcb_at thread and st_tcb_at (Not \<circ> awaiting_reply) a and valid_reply_caps and valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) else tcb_at a else tcb_at a and (\<lambda>s. valid_etcbs s \<and> (weak_valid_sched_action and (\<lambda>s. runnable Structures_A.thread_state.Running)) s \<and> cur_tcb s \<and> K (runnable Structures_A.thread_state.Running) s)) s
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and ?Q'244 word1 word2 right ntfnPtr rv rv' a lista data) s
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 5. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>word1 word2 right rv rv' a data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (Not \<circ> awaiting_reply) a s \<and> st_tcb_at (Not \<circ> halted) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> (sender_can_grant data \<longrightarrow> \<not> sender_is_call data \<longrightarrow> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s) \<and> (sender_can_grant_reply data \<longrightarrow> \<not> sender_is_call data \<longrightarrow> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s) \<and> (\<not> sender_can_grant data \<and> \<not> sender_can_grant_reply data \<longrightarrow> (sender_is_call data \<longrightarrow> tcb_at a s) \<and> (\<not> sender_is_call data \<longrightarrow> tcb_at a s \<and> valid_etcbs s \<and> weak_valid_sched_action s))
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s)) s
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 4. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; (tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> (if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then tcb_at' a and tcb_at' thread and valid_pspace' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) else tcb_at' a else tcb_at' a and (\<lambda>s. (Invariants_H.valid_queues s \<and> ((\<exists>p. a \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> valid_queues' s \<and> (weak_sch_act_wf (ksSchedulerAction s) s \<and> (ksSchedulerAction s = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> cur_tcb' s \<and> tcb_at' a s \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Running \<and> tcb_at' a s) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a s)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') s)) s
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 3. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q230 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace> do_ipc_transfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. valid_objs and valid_mdb and valid_list and valid_sched and cur_tcb and valid_reply_caps and pspace_aligned and pspace_distinct and st_tcb_at (Not \<circ> awaiting_reply) a and st_tcb_at (Not \<circ> halted) a and tcb_at thread and valid_reply_masters and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)\<rbrace>
 2. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'229 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and cur_tcb' and Invariants_H.valid_queues and valid_queues' and valid_pspace' and valid_objs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and ?Q230 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya sender_state and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and ?Q'229 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'413 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (valid_objs and valid_mdb) b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> valid_sched b \<and> cur_tcb b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> pspace_aligned b \<and> pspace_distinct b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a b \<and> st_tcb_at (\<lambda>a. \<not> halted a) a b \<and> tcb_at thread b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) and tcb_at thread) b) and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>ba. tcb_at' a ba \<and> tcb_at' thread ba \<and> cur_tcb' ba \<and> Invariants_H.valid_queues ba \<and> valid_queues' ba \<and> valid_pspace' ba \<and> (valid_objs' and valid_mdb') ba \<and> ?P'413 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b ba)\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 word2 right ntfnPtr rv rv' a lista data. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'413 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista () () (Structures_H.thread_state.BlockedOnSend word1 (sender_badge data) (sender_can_grant data) (sender_can_grant_reply data) (sender_is_call data))\<rbrace> doIPCTransfer a (Some word1) (sender_badge data) (sender_can_grant data) thread \<lbrace>\<lambda>_ s. sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace> get_thread_state a \<lbrace>\<lambda>sender_state. tcb_at a and tcb_at thread and valid_objs and pspace_aligned and valid_list and pspace_distinct and valid_mdb and cur_tcb and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) and (\<lambda>b. (valid_objs and valid_mdb) b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_list b \<and> valid_sched b \<and> cur_tcb b \<and> (valid_reply_caps and (valid_reply_masters and valid_objs and valid_mdb)) b \<and> pspace_aligned b \<and> pspace_distinct b \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a b \<and> st_tcb_at (\<lambda>a. \<not> halted a) a b \<and> tcb_at thread b \<and> (valid_reply_masters and (valid_reply_caps and valid_objs and valid_mdb)) b \<and> (valid_objs and cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) and tcb_at thread) b) and (\<lambda>s. \<exists>data. sender_state = Structures_A.thread_state.BlockedOnSend word1 data)\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace> getThreadState a \<lbrace>\<lambda>b. tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>ba. tcb_at' a ba \<and> tcb_at' thread ba \<and> cur_tcb' ba \<and> Invariants_H.valid_queues ba \<and> valid_queues' ba \<and> valid_pspace' ba \<and> (valid_objs' and valid_mdb') ba \<and> ?P'413 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y ya b ba)\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>y. tcb_at a and ?Q201 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista y\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and ?Q'203 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista ya\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 10. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
A total of 18 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?P'468 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list)) \<lbrace>\<lambda>rv s. valid_objs s \<and> valid_mdb s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_objs s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> valid_objs s \<and> valid_mdb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnSend word1 data) a s\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> valid_pspace' b \<and> (valid_objs' and valid_mdb') b \<and> sch_act_wf (ksSchedulerAction b) b))\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> tcb_at thread s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at word1 s \<and> ?P'468 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s)) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?P'468 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista\<rbrace> set_endpoint word1 (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list)) \<lbrace>\<lambda>rv s. valid_objs s \<and> valid_mdb s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_objs s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> valid_objs s \<and> valid_mdb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>rv. \<exists>data. rv = Structures_A.thread_state.BlockedOnSend word1 data) a s\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> valid_pspace' b \<and> (valid_objs' and valid_mdb') b \<and> sch_act_wf (ksSchedulerAction b) b))\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> tcb_at thread s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at word1 s \<and> ?P'468 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s)) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (tcb_at' a and tcb_at' thread and valid_pspace' and cur_tcb' and (\<lambda>s. case Some word1 of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) and (\<lambda>b. tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> valid_pspace' b \<and> (valid_objs' and valid_mdb') b \<and> sch_act_wf (ksSchedulerAction b) b))\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> tcb_at thread s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at word1 s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>?Q'189 word1 word2 right (Structures_A.endpoint.SendEP (a # lista)) (Structures_H.endpoint.SendEP (a # lista)) ntfnPtr ntfnPtr rv rv' (a # lista) a lista\<rbrace> setEndpoint word1 (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista) \<lbrace>\<lambda>ya. tcb_at' a and (\<lambda>b. tcb_at' a b \<and> tcb_at' thread b \<and> valid_pspace' b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> valid_pspace' b \<and> valid_objs' b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> tcb_at thread s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at word1 s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'189 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.SendEP (a # lista)) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (ep_at word1 and (\<lambda>s. tcb_at a s \<and> tcb_at a s \<and> tcb_at thread s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # lista \<Rightarrow> Structures_A.endpoint.SendEP (drop (Suc 0) list))))) s \<and> pspace_aligned s \<and> valid_list s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> ep_at word1 s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_list s \<and> valid_sched s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> tcb_at thread s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))) and K (is_simple_type (Endpoint (case lista of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP (a # list))))) s \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (thread, tcb_cnode_index 3) s \<and> tcb_at thread s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right rv rv' a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; invs s; valid_list s; valid_sched s; tcb_at thread s; ep_at word1 s; valid_ep (Structures_A.endpoint.SendEP (a # lista)) s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 s; cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s; ex_nonz_cap_to thread s\<rbrakk> \<Longrightarrow> (lista = [] \<longrightarrow> tcb_at a s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> valid_mdb s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> pspace_aligned s \<and> pspace_distinct s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> valid_mdb s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s) \<and> (\<forall>x21 x22. lista = x21 # x22 \<longrightarrow> tcb_at a s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> cur_tcb s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> valid_mdb s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> cur_tcb s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> valid_mdb s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> valid_reply_masters s \<and> valid_reply_caps s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> valid_mdb s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right rv rv' a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; valid_list s; valid_sched s; tcb_at thread s; ep_at word1 s; valid_ep (Structures_A.endpoint.SendEP (a # lista)) s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 s; cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s; ex_nonz_cap_to thread s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> (lista = [] \<longrightarrow> tcb_at a s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> valid_objs s \<and> valid_ep Structures_A.endpoint.IdleEP s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s) \<and> (\<forall>x21 x22. lista = x21 # x22 \<longrightarrow> tcb_at a s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> valid_objs s \<and> valid_ep (Structures_A.endpoint.SendEP (x21 # x22)) s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right rv rv' a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; valid_list s; valid_sched s; tcb_at thread s; ep_at word1 s; obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista))) word1 s; cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s; ex_nonz_cap_to thread s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; tcb_at a s; valid_objs s; \<forall>t\<in>set lista. tcb_at t s; pspace_aligned s; a \<notin> set lista; distinct lista; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> (lista = [] \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s) \<and> (\<forall>x21 x22. lista = x21 # x22 \<longrightarrow> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right rv rv' a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ntfn_relation rv rv'; valid_list s; valid_sched s; tcb_at thread s; ep_at word1 s; cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s; ex_nonz_cap_to thread s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; tcb_at a s; valid_objs s; \<forall>t\<in>set lista. tcb_at t s; pspace_aligned s; a \<notin> set lista; distinct lista; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); \<exists>k. k = Endpoint (Structures_A.endpoint.SendEP (a # lista)) \<and> state_refs_of s word1 = refs_of k \<and> (\<forall>(x, tp)\<in>refs_of k. obj_at (\<lambda>k. (word1, symreftype tp) \<in> refs_of k) x s)\<rbrakk> \<Longrightarrow> (lista = [] \<longrightarrow> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s) \<and> (\<forall>x21 x22. lista = x21 # x22 \<longrightarrow> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> st_tcb_at (\<lambda>a. a \<noteq> Structures_A.thread_state.BlockedOnReply) a s \<and> st_tcb_at (\<lambda>a. \<not> halted a) a s \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> x21 \<notin> set x22 \<and> distinct x22 \<and> st_tcb_at (\<lambda>a. \<exists>data. a = Structures_A.thread_state.BlockedOnSend word1 data) a s)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' list a lista s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.SendEP (a # lista); ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.SendEP (a # lista); list = a # lista; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.SendEP (a # lista))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>b. tcb_at' a b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> cur_tcb' b \<and> ep_at' word1 b \<and> tcb_at' a b \<and> tcb_at' thread b \<and> cur_tcb' b \<and> Invariants_H.valid_queues b \<and> valid_queues' b \<and> (valid_pspace' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> (valid_objs' and valid_ep' (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista)) b \<and> valid_mdb' b \<and> sch_act_wf (ksSchedulerAction b) b)) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa) (case ep of Structures_A.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP [thread])
od | False \<Rightarrow> do_nbrecv_failed_transfer thread | Structures_A.endpoint.SendEP q \<Rightarrow> do assert (q \<noteq> []);
queue <- return $ tl q;
sender <- return $ hd q;
set_endpoint word1 $ case queue of [] \<Rightarrow> Structures_A.endpoint.IdleEP | a # list \<Rightarrow> Structures_A.endpoint.SendEP queue;
sender_state <- get_thread_state sender;
data <- case sender_state of Structures_A.thread_state.BlockedOnSend ref x \<Rightarrow> return x | _ \<Rightarrow> fail;
do_ipc_transfer sender (Some word1) (sender_badge data) (sender_can_grant data) thread;
if sender_is_call data then if sender_can_grant data \<or> sender_can_grant_reply data then setup_caller_cap sender thread (AllowGrant \<in> right) else set_thread_state sender Structures_A.thread_state.Inactive else do set_thread_state sender Structures_A.thread_state.Running;
do_extended_op (possible_switch_to sender)
od
od | Structures_A.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (queue @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case epa of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ queue @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) badge canGrant thread;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender thread (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) (case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ x3 @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3\<rbrakk> \<Longrightarrow> corres dc (?Q898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) (?Q'898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) (case isBlocking of True \<Rightarrow> do set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (x3 @ [thread]))
od | False \<Rightarrow> do_nbrecv_failed_transfer thread) (case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) (capEPCanGrant (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)))) thread;
setEndpoint (capEPPtr (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) $ Structures_H.endpoint.RecvEP $ x3 @ [thread]
od | False \<Rightarrow> doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> ?Q898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> ?Q'898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> corres dc (?Q898 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (?Q'898 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do y <- set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>);
set_endpoint word1 (Structures_A.endpoint.RecvEP (x3 @ [thread]))
od) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread;
setEndpoint word1 (Structures_H.endpoint.RecvEP (x3 @ [thread]))
od)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (?Q898 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (?Q'898 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> ?Q898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> ?Q'898 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> thread_state_relation (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 y) (?R'906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 ya) (set_endpoint word1 (Structures_A.endpoint.RecvEP (x3 @ [thread]))) (setEndpoint word1 (Structures_H.endpoint.RecvEP (x3 @ [thread])))
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>?R906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>?R'906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (tcb_at' thread and ?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q912 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'910 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 9. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 y) (?R'906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 ya) (set_endpoint word1 (Structures_A.endpoint.RecvEP (x3 @ [thread]))) (setEndpoint word1 (Structures_H.endpoint.RecvEP (x3 @ [thread])))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>?R906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>?R'906 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (tcb_at' thread and ?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q912 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'910 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 y ya. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking; dc y ya\<rbrakk> \<Longrightarrow> ep_relation (Structures_A.endpoint.RecvEP (x3 @ [thread])) (Structures_H.endpoint.RecvEP (x3 @ [thread]))
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>\<lambda>y. ep_at word1\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>\<lambda>ya. ep_at' word1\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (tcb_at' thread and ?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q912 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'910 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 8. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 10. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> set_thread_state thread (Structures_A.thread_state.BlockedOnReceive word1 \<lparr>receiver_can_grant = AllowGrant \<in> right\<rparr>) \<lbrace>\<lambda>y. ep_at word1\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive word1 (AllowGrant \<in> right)) thread \<lbrace>\<lambda>ya. ep_at' word1\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ?Q912 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (tcb_at' thread and ?Q'910 word1 word2 right (Structures_A.endpoint.RecvEP x3) (Structures_H.endpoint.RecvEP x3) ntfnPtr ntfnPtr rv rv' x3) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q912 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'910 word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3) s
 6. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 7. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 8. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 9. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 10. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
A total of 15 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking\<rbrakk> \<Longrightarrow> corres dc (tcb_at thread and ep_at word1) (tcb_at' thread and ep_at' word1) (do_nbrecv_failed_transfer thread) (doNBRecvFailedTransfer thread)
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; \<not> isBlocking; (tcb_at' thread and ep_at' word1) s\<rbrakk> \<Longrightarrow> tcb_at' thread s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 5. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 7. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (einvs and tcb_at thread and ep_at word1 and valid_ep (Structures_A.endpoint.RecvEP x3) and obj_at (\<lambda>k. k = Endpoint (Structures_A.endpoint.RecvEP x3)) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread) s\<rbrakk> \<Longrightarrow> (tcb_at thread and ep_at word1) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 4. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 6. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr rv rv' x3 s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); epa = Structures_H.endpoint.RecvEP x3; ntfnptr = ntfnPtr; ntfn_relation rv rv'; ep = Structures_A.endpoint.RecvEP x3; (invs' and tcb_at' thread and ep_at' word1 and valid_ep' (Structures_H.endpoint.RecvEP x3)) s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ep_at' word1) s
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 3. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 5. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q39 word1 word2 right ep epa ntfnptr\<rbrace> case ntfnptr of None \<Rightarrow> return default_notification | Some x \<Rightarrow> get_notification x \<lbrace>\<lambda>rv. if (\<exists>y. ntfnptr = Some y) \<and> Ipc_A.isActive rv then ntfn_at (the ntfnPtr) and tcb_at thread and pspace_aligned and valid_objs else einvs and valid_sched and tcb_at thread and ep_at word1 and valid_ep ep and obj_at (\<lambda>k. k = Endpoint ep) word1 and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) and ex_nonz_cap_to thread\<rbrace>
 2. \<And>word1 word2 right ep epa ntfnptr ntfnPtr. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ntfnptr = ntfnPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>rv'. if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive rv' then ntfn_at' (the ntfnPtr) and tcb_at' thread and valid_pspace' and obj_at' EndpointDecls_H.isActive (the ntfnPtr) else invs' and tcb_at' thread and ep_at' word1 and valid_ep' epa\<rbrace>
 3. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 word1 word2 right ep epa\<rbrace> get_bound_notification thread \<lbrace>\<lambda>ntfnptr. (case ntfnptr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) and ?Q39 word1 word2 right ep epa ntfnptr\<rbrace>
 4. \<And>word1 word2 right ep epa. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'32 word1 word2 right ep epa\<rbrace> getBoundNotification thread \<lbrace>\<lambda>ntfnPtr. (case ntfnPtr of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) and ?Q'41 word1 word2 right ep epa ntfnPtr\<rbrace>
 5. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R23 word1 word2 right ep s\<rbrakk> \<Longrightarrow> (tcb_at thread and ?Q32 word1 word2 right ep epa) s
 6. \<And>word1 word2 right ep epa s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); ep_relation ep epa; ?R'23 word1 word2 right epa s\<rbrakk> \<Longrightarrow> (tcb_at' thread and ?Q'32 word1 word2 right ep epa) s
 7. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q23 word1 word2 right\<rbrace> get_endpoint word1 \<lbrace>?R23 word1 word2 right\<rbrace>
 8. \<And>word1 word2 right. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'23 word1 word2 right\<rbrace> getEndpoint word1 \<lbrace>?R'23 word1 word2 right\<rbrace>
 9. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (einvs and tcb_at thread and valid_cap (cap.EndpointCap word1 word2 right) and ex_nonz_cap_to thread and cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3)) s\<rbrakk> \<Longrightarrow> (ep_at word1 and ?Q23 word1 word2 right) s
 10. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and ?Q'23 word1 word2 right) s proof (prove)
goal (2 subgoals):
 1. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); invs s; valid_list s; valid_sched s; tcb_at thread s; s \<turnstile> cap.EndpointCap word1 word2 right; ex_nonz_cap_to thread s; cte_wp_at (\<lambda>c. c = cap.NullCap) (thread, tcb_cnode_index 3) s\<rbrakk> \<Longrightarrow> ep_at word1 s \<and> (\<forall>x. bound_tcb_at ((=) x) thread s \<longrightarrow> (case x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at x) s \<and> ((\<exists>y. x = Some y) \<or> ep_at word1 s) \<and> (\<forall>xa. x = Some xa \<longrightarrow> (\<forall>x. ko_at (Notification x) xa s \<longrightarrow> (Ipc_A.isActive x \<longrightarrow> ntfn_at xa s \<and> pspace_aligned s \<and> valid_objs s) \<and> (Ipc_A.isActive x \<or> ep_at word1 s))))
 2. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>s. tcb_at' thread s \<and> (\<forall>x. \<not> bound_tcb_at' ((=) x) thread s \<or> (case x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) s \<and> (x \<noteq> None \<or> invs' s \<and> tcb_at' thread s \<and> ep_at' word1 s \<and> (invs' and ep_at' word1) s) \<and> (\<forall>xa. x \<noteq> Some xa \<or> (\<forall>x. \<not> ko_at' x xa s \<or> (\<not> EndpointDecls_H.isActive x \<or> ntfn_at' xa s \<and> tcb_at' thread s \<and> valid_pspace' s \<and> obj_at' EndpointDecls_H.isActive xa s) \<and> (\<not> \<not> EndpointDecls_H.isActive x \<or> (invs' and tcb_at' thread and ep_at' word1) s \<and> (invs' and ep_at' word1) s)))))) s proof (prove)
goal (1 subgoal):
 1. \<And>word1 word2 right s. \<lbrakk>cap = cap.EndpointCap word1 word2 right; cap' = capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right); (invs' and tcb_at' thread and valid_cap' (capability.EndpointCap word1 word2 (AllowWrite \<in> right) (AllowRead \<in> right) (AllowGrant \<in> right) (AllowGrantReply \<in> right))) s\<rbrakk> \<Longrightarrow> (ep_at' word1 and (\<lambda>s. tcb_at' thread s \<and> (\<forall>x. \<not> bound_tcb_at' ((=) x) thread s \<or> (case x of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> ntfn_at' x) s \<and> (x \<noteq> None \<or> invs' s \<and> tcb_at' thread s \<and> ep_at' word1 s \<and> (invs' and ep_at' word1) s) \<and> (\<forall>xa. x \<noteq> Some xa \<or> (\<forall>x. \<not> ko_at' x xa s \<or> (\<not> EndpointDecls_H.isActive x \<or> ntfn_at' xa s \<and> tcb_at' thread s \<and> valid_pspace' s \<and> obj_at' EndpointDecls_H.isActive xa s) \<and> (\<not> \<not> EndpointDecls_H.isActive x \<or> (invs' and tcb_at' thread and ep_at' word1) s \<and> (invs' and ep_at' word1) s)))))) s proof (prove)
goal:
No subgoals!