theory CNode_DR

lemma dcorres_ep_cancel_badge_sends:
  notes hoare_post_taut[wp]
  shows
  "dcorres dc \<top> (valid_state and valid_etcbs)
    (CSpace_D.cancel_badged_sends epptr word2)
    (IpcCancel_A.cancel_badged_sends epptr word2)" supply if_cong[cong] apply (clarsimp simp:IpcCancel_A.cancel_badged_sends_def) apply (rule dcorres_expand_pfx) apply clarsimp apply (rule_tac Q' = "\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r"
                in corres_symb_exec_r) apply (case_tac rv) apply (clarsimp simp: cancel_badged_sends_def') apply (rule dcorres_absorb_get_l) apply (rule corres_guard_imp[OF filter_modify_empty_corres]) apply (clarsimp simp:invs_def) apply (frule_tac epptr = epptr in get_endpoint_pick ,simp add:obj_at_def) apply (cut_tac ep = epptr and s = "transform s'" in is_thread_blocked_on_sth) apply (drule_tac x = x in eqset_imp_iff) apply (clarsimp simp: valid_state_def valid_ep_abstract_def none_is_sending_ep_def
                               none_is_receiving_ep_def) apply (clarsimp simp: ntfn_waiting_set_lift ep_waiting_set_send_lift
                               ep_waiting_set_recv_lift) apply (drule ep_not_waiting_ntfn[rotated]) apply (simp add:valid_pspace_def) apply auto[1] apply simp+ apply (rule dcorres_expand_pfx) apply (rule_tac
        Q'="\<lambda>r s. s = (update_kheap ((kheap s')(epptr\<mapsto> (Endpoint Structures_A.endpoint.IdleEP))) s')"
        in dcorres_symb_exec_r) apply (clarsimp simp: filterM_mapM cancel_badged_sends_def') apply (rule dcorres_absorb_get_l) apply (rule corres_dummy_return_l) apply (rule corres_split_forwards'[where r'=dc]) apply (rule corres_mapM_to_mapM_x) apply (rule corres_guard_imp) apply (rule_tac lift_func = id in set_list_modify_corres_helper) apply (simp add:valid_ep_def) apply (simp add:inj_on_def) apply (simp add:is_thread_blocked_on_sth[simplified]) apply (subgoal_tac "valid_idle s'a \<and> valid_etcbs s'a") apply (clarsimp simp: ntfn_waiting_set_lift ep_waiting_set_send_lift
                                      ep_waiting_set_recv_lift) apply (subst ntfn_waiting_set_upd_kh) apply (simp add:obj_at_def is_ep_def) apply (subst ep_waiting_set_send_upd_kh) apply (simp add:obj_at_def is_ep_def) apply (subst ep_waiting_set_recv_upd_kh) apply (simp add:obj_at_def is_ep_def) apply (frule_tac epptr = epptr in get_endpoint_pick) apply (simp add:obj_at_def) apply (clarsimp simp:valid_ep_abstract_def none_is_receiving_ep_def) apply (subst ep_not_waiting_ntfn) apply (simp add:valid_state_def valid_pspace_def) apply (simp add:obj_at_def) apply (rule set_eqI) apply (clarsimp simp:image_def) apply (rule conjI) apply (clarsimp simp:valid_idle_def valid_state_def pred_tcb_at_def obj_at_def) apply (clarsimp simp: obj_at_def, frule(1) valid_etcbs_ko_etcb) apply (clarsimp simp: valid_etcbs_def obj_at_def st_tcb_at_def st_tcb_at_kh_def
                                     obj_at_kh_def is_etcb_at_def) apply (clarsimp simp: tcb_filter_modify_def bind_assoc thread_get_def
                                    get_thread_state_def) apply (rule_tac
                Q'="\<lambda>s. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s
                      \<and> idle_thread s = idle_thread s' \<and>
                st_tcb_at (\<lambda>ts. \<exists>pl. ts = Structures_A.thread_state.BlockedOnSend epptr pl) a s"
                in corres_guard_imp[where Q=\<top>]) apply (rule dcorres_absorb_gets_the) apply (clarsimp simp:pred_tcb_at_def obj_at_def dest!:get_tcb_SomeD) apply (rule conjI) apply (clarsimp simp:set_thread_state_def bind_assoc | rule conjI)+ apply (rule dcorres_absorb_gets_the) apply (rule corres_guard_imp) apply (rule_tac P="(=) (transform s'b)" and P'="(=) s'b"
                               and Q=\<top> and Q'=\<top> in corres_split_noop_rhs2) apply (clarsimp simp: set_object_def get_object_def in_monad simpler_modify_def
                                            get_def return_def bind_def put_def corres_underlying_def) apply (clarsimp simp:transform_def transform_current_thread_def) apply (rule ext) apply (frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp:transform_objects_tcb not_idle_thread_def ) apply (clarsimp simp:transform_tcb_def transform_objects_def
                        get_tcb_ep_badge_def remove_pending_operation_def get_tcb_SomeD get_etcb_SomeD) apply (fastforce simp: restrict_map_def map_add_def map_def tcb_slot_defs) apply (rule dcorres_rhs_noop_above_True[OF set_thread_state_ext_dcorres]) apply (rule dcorres_rhs_noop_above_True[OF tcb_sched_action_dcorres]) apply simp apply (wp | simp)+ apply (clarsimp simp: simpler_modify_def corres_underlying_def return_def
                                      transform_def
                               dest!: get_tcb_rev) apply (rule ext) apply (frule(1) valid_etcbs_get_tcb_get_etcb, clarsimp) apply (case_tac "a=idle_thread s'a", simp add: not_idle_thread_def) apply (drule (2) transform_objects_tcb) apply (clarsimp simp: transform_current_thread_def transform_def) apply (clarsimp simp: not_idle_thread_def transform_tcb_def transform_def
                                      get_tcb_ep_badge_def remove_pending_operation_def tcb_slot_defs
                                      infer_tcb_pending_op_def infer_tcb_bound_notification_def) apply simp+ apply (clarsimp simp:bind_assoc not_idle_thread_def) apply (wp sts_st_tcb_at_neq) apply (rule_tac Q="\<lambda>r a. valid_idle a \<and> idle_thread a = idle_thread s' \<and>
                st_tcb_at (\<lambda>ts. \<exists>pl. ts = Structures_A.thread_state.BlockedOnSend epptr pl) y a
               \<and> y \<noteq> idle_thread a \<and> valid_etcbs a" in hoare_strengthen_post) apply wp apply clarsimp+ apply (frule pending_thread_in_send_not_idle) apply (simp add:valid_state_def)+ apply (clarsimp simp:not_idle_thread_def) apply fastforce apply fastforce apply (frule_tac epptr = epptr in get_endpoint_pick, simp add:obj_at_def) apply (clarsimp simp:valid_ep_abstract_def ep_waiting_set_send_def) apply (clarsimp simp:valid_idle_def pred_tcb_at_def obj_at_def valid_ep_abstract_def) apply (rule conjI,clarsimp) apply (clarsimp simp:valid_state_def) apply (frule_tac y = x in generates_pending_not_idle) apply (fastforce simp:pred_tcb_at_def obj_at_def) apply (frule ep_not_idle) apply (fastforce simp:obj_at_def is_ep_def) apply (clarsimp simp:not_idle_thread_def valid_idle_def pred_tcb_at_def obj_at_def) apply (clarsimp simp: valid_etcbs_2_def) apply (drule_tac x=ptr in spec) apply (clarsimp simp: st_tcb_at_kh_def obj_at_kh_def st_tcb_at_def obj_at_def) apply wp+ apply (clarsimp) apply (rule corres_guard_imp) apply (rule corres_split_noop_rhs[OF corres_dummy_set_sync_ep]) apply (rule reschedule_required_dcorres[THEN corres_trivial]) apply (wp set_ep_exec_wp|clarsimp)+ apply (rule dcorres_to_wp[where Q=\<top>,simplified]) apply (rule corres_dummy_set_sync_ep) apply (clarsimp simp: cancel_badged_sends_def'') apply (rule dcorres_absorb_get_l) apply (rule corres_guard_imp[OF filter_modify_empty_corres]) apply (frule_tac epptr = epptr in get_endpoint_pick ,simp add:obj_at_def) apply (cut_tac ep = epptr and s = "transform s'a" in is_thread_blocked_on_sth) apply clarsimp apply (drule_tac x = x in eqset_imp_iff) apply (clarsimp simp: valid_state_def valid_ep_abstract_def none_is_sending_ep_def
                             none_is_receiving_ep_def) apply (clarsimp simp: ntfn_waiting_set_lift ep_waiting_set_send_lift
                             ep_waiting_set_recv_lift image_def) apply (drule ep_not_waiting_ntfn[rotated]) apply (simp add:valid_pspace_def) apply (clarsimp simp: restrict_map_def transform_def transform_objects_def) apply (clarsimp simp: ep_waiting_set_recv_def restrict_map_def transform_def
                      split: if_split_asm dest!: get_tcb_rev elim!: CollectE) apply (frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp: transform_tcb_def transform_objects_def infer_tcb_bound_notification_def
                             is_thread_blocked_on_endpoint_def infer_tcb_pending_op_def tcb_slot_defs
                      dest!: get_tcb_SomeD get_etcb_SomeD) apply (clarsimp simp: get_tcb_ep_badge_def tcb_slot_defs
                      split: option.splits cdl_cap.splits) apply clarsimp+ apply (wpsimp wp: get_simple_ko_sp get_simple_ko_ko_at
                      get_simple_ko_valid[where f=Endpoint, simplified valid_ep_def2[symmetric]]
                simp:valid_state_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (valid_state and valid_etcbs) (CSpace_D.cancel_badged_sends epptr word2) (IpcCancel_A.cancel_badged_sends epptr word2) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (valid_state and valid_etcbs) (CSpace_D.cancel_badged_sends epptr word2) (IpcCancel_A.cancel_badged_sends epptr word2) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (valid_state and valid_etcbs) (CSpace_D.cancel_badged_sends epptr word2) (do ep <- get_endpoint epptr;
case ep of SendEP queue \<Rightarrow> do set_endpoint epptr IdleEP;
queue' <- swp filterM queue (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do set_thread_state t Restart;
do_extended_op (tcb_sched_action tcb_sched_enqueue t);
return False
od else return True
od);
ep' <- return (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
set_endpoint epptr ep';
do_extended_op reschedule_required
od | _ \<Rightarrow> return ()
od) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; (valid_state and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (CSpace_D.cancel_badged_sends epptr word2) (do ep <- get_endpoint epptr;
case ep of SendEP queue \<Rightarrow> do set_endpoint epptr IdleEP;
queue' <- swp filterM queue (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do set_thread_state t Restart;
do_extended_op (tcb_sched_action tcb_sched_enqueue t);
return False
od else return True
od);
ep' <- return (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
set_endpoint epptr ep';
do_extended_op reschedule_required
od | _ \<Rightarrow> return ()
od) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (CSpace_D.cancel_badged_sends epptr word2) (get_endpoint epptr >>= case_endpoint (return ()) (\<lambda>queue. do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od) (\<lambda>x. return ())) proof (prove)
goal (4 subgoals):
 1. \<And>s' rv. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 2. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 3. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' rv. \<lbrakk>valid_state s'; valid_etcbs s'; rv = IdleEP\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 2. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) (do s <- get;
tcb_filter_modify {x. \<exists>tcb. cdl_objects s x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)
od) (return ())
 2. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (return ())
 2. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = {}
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; valid_ep_abstract IdleEP epptr s'; {x. \<exists>tcb. cdl_objects (transform s') x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = get_waiting_sync_recv_threads epptr (transform s') \<union> get_waiting_sync_send_threads epptr (transform s') \<union> get_waiting_ntfn_recv_threads epptr (transform s')\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; valid_ep_abstract IdleEP epptr s'; (x \<in> {x. \<exists>tcb. cdl_objects (transform s') x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr}) = (x \<in> get_waiting_sync_recv_threads epptr (transform s') \<union> get_waiting_sync_send_threads epptr (transform s') \<union> get_waiting_ntfn_recv_threads epptr (transform s'))\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; x \<in> get_waiting_sync_recv_threads epptr (transform s') \<or> x \<in> get_waiting_sync_send_threads epptr (transform s') \<or> x \<in> get_waiting_ntfn_recv_threads epptr (transform s'); valid_pspace s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); valid_mdb s'; ep_waiting_set_send epptr s' = {}; ep_waiting_set_recv epptr s' = {}; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); valid_mdb s'; ep_waiting_set_send epptr s' = {}; ep_waiting_set_recv epptr s' = {}; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (9 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; ep_waiting_set_send epptr s' = {}; ep_waiting_set_recv epptr s' = {}; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>s' x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; ep_waiting_set_send epptr s' = {}; ep_waiting_set_recv epptr s' = {}; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}\<rbrakk> \<Longrightarrow> False
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 8. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (8 subgoals):
 1. \<And>s' x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep IdleEP s'; cdl_objects (transform s') x = Some (Tcb tcb); is_thread_blocked_on_endpoint tcb epptr; x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; ep_waiting_set_send epptr s' = {}; ep_waiting_set_recv epptr s' = {}; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 7. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 2. \<And>s' s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint IdleEP) epptr and valid_ep IdleEP) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (5 subgoals):
 1. \<And>s' rv x2. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) (CSpace_D.cancel_badged_sends epptr word2) (do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) x2;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od)
 2. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 4. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (5 subgoals):
 1. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (CSpace_D.cancel_badged_sends epptr word2) (do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) x2;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od)
 2. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 4. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' rv x2 s s'a rva. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) (\<lambda>s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') (CSpace_D.cancel_badged_sends epptr word2) (do queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) x2;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) (\<lambda>s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') (do s <- get;
tcb_filter_modify {x. \<exists>tcb. cdl_objects s x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)
od) (do ys <- mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2;
y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do ys <- mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2;
y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) >>= return) (do ys <- mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2;
y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (mapM_x (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (12 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> dcorres dc (?Q87 s' x2 s'a) (?Q'87 s' x2 s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (mapM_x (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2)
 2. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q87 s' x2 s'a s
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> ?Q'87 s' x2 s'a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 7. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 8. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> distinct x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> inj_on id (set x2)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = id ` set x2
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> inj_on id (set x2)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = id ` set x2
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = id ` set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> get_waiting_sync_recv_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) \<union> get_waiting_sync_send_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) \<union> get_waiting_ntfn_recv_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; valid_idle s'a \<and> valid_etcbs s'a\<rbrakk> \<Longrightarrow> get_waiting_sync_recv_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) \<union> get_waiting_sync_send_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) \<union> get_waiting_ntfn_recv_threads epptr (transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')) = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ep_waiting_set_send epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ntfn_waiting_set epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_at epptr s'
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ep_waiting_set_send epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ntfn_waiting_set epptr s' = set x2
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ep_waiting_set_send epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ntfn_waiting_set epptr s' = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_at epptr s'
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_at epptr s'
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s' \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s' \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))\<rbrakk> \<Longrightarrow> kheap s' epptr = Some (kernel_object.Endpoint (?endpoint106 s' x2))
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); valid_ep_abstract (?endpoint106 s' x2) epptr s'\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s' \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s' \<union> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = set x2
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s' \<union> ntfn_waiting_set epptr s' = ep_waiting_set_send epptr s'
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> kheap s' epptr = Some (kernel_object.Endpoint (?ep116 s' x2))
 3. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s' \<union> {} = ep_waiting_set_send epptr s'
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 8. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> kheap s' epptr = Some (kernel_object.Endpoint (?ep116 s' x2))
 2. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s' \<union> {} = ep_waiting_set_send epptr s'
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> ep_waiting_set_send epptr s' \<union> {} = ep_waiting_set_send epptr s'
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 x. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> (x \<in> ep_waiting_set_send epptr s' \<union> {}) = (x \<in> ep_waiting_set_send epptr s')
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a \<and> valid_etcbs s'a
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_idle s'a
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> valid_etcbs s'a
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); \<exists>tcb. (kernel_object.Endpoint (SendEP x2) = TCB tcb) = (\<exists>etcb. ekheap s' epptr = Some etcb)\<rbrakk> \<Longrightarrow> valid_etcbs_2 (ekheap s') ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>a\<in>set x2. dcorres dc (\<lambda>_. True) (?P91 s' x2 s'a a) (tcb_filter_modify {id a} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x)) (do v <- do st <- get_thread_state a;
if blocking_ipc_badge st = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True
od;
return (a, v)
od)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do x <- gets_the (get_tcb a);
v <- if blocking_ipc_badge (tcb_state x) = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True;
return (a, v)
od)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do x <- gets_the (get_tcb a);
v <- if blocking_ipc_badge (tcb_state x) = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True;
return (a, v)
od)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj'. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a \<and> valid_etcbs s'a \<and> not_idle_thread a s'a \<and> idle_thread s'a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s'a; get_tcb a s'a = Some obj'; True\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do v <- if blocking_ipc_badge (tcb_state obj') = word2 then do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od else return True;
return (a, v)
od)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> (sender_badge pl = word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do v <- do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od;
return (a, v)
od)) \<and> (sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True)))
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl = word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do v <- do y <- set_thread_state a Restart;
y <- tcb_sched_action tcb_sched_enqueue a;
return False
od;
return (a, v)
od)
 2. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do x <- gets_the (get_tcb a);
x <- KHeap_A.set_object a (TCB (update_tcb_state Restart x));
x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 2. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'b)) ((=) s'b) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do x <- KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a));
x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 2. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?Q216 s' x2 a s'a obj' pl s'b obj'a) (?Q'216 s' x2 a s'a obj' pl s'b obj'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (do x <- KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a));
x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ?Q216 s' x2 a s'a obj' pl s'b obj'a s
 3. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ?Q'216 s' x2 a s'a obj' pl s'b obj'a s
 4. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 5. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 8. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'b)) ((=) s'b) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)))
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; not_idle_thread a s'b; idle_thread s'b = idle_thread s'; kheap s'b a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'a\<rbrakk> \<Longrightarrow> transform (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) = transform s'b\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects (transform s'b) a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects (transform s'b) x else cdl_objects (transform s'b) x\<rparr>
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; not_idle_thread a s'b; idle_thread s'b = idle_thread s'; kheap s'b a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'a\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) = (\<lambda>x. if x = a then case transform_objects s'b a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects (transform s'b) x else transform_objects s'b x)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b obj'a x. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; not_idle_thread a s'b; idle_thread s'b = idle_thread s'; kheap s'b a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'a\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) x = (if x = a then case transform_objects s'b a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects (transform s'b) x else transform_objects s'b x)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b obj'a x. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; not_idle_thread a s'b; idle_thread s'b = idle_thread s'; kheap s'b a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'a; \<exists>etcb. get_etcb a s'b = Some etcb\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) x = (if x = a then case transform_objects s'b a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects (transform s'b) x else transform_objects s'b x)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b obj'a x etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; a \<noteq> idle_thread s'; idle_thread s'b = idle_thread s'; kheap s'b a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'a; get_etcb a s'b = Some etcb\<rbrakk> \<Longrightarrow> (x = a \<longrightarrow> transform_objects (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) a = (case transform_tcb (machine_state s'b) a obj'a etcb of Tcb tcb \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects (transform s'b) x)) \<and> (x \<noteq> a \<longrightarrow> transform_objects (update_kheap ((kheap s'b)(a \<mapsto> TCB (update_tcb_state Restart obj'a))) s'b) x = transform_objects s'b x)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s' x2 a obj' pl s'b x etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr)) = (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((if epptr \<noteq> idle_thread s' then (kheap s' |` (- {idle_thread s'} - {epptr}))(epptr \<mapsto> kernel_object.Endpoint IdleEP) else kheap s' |` (- {idle_thread s'})) ptr)); a \<in> set x2; valid_idle s'b; valid_etcbs s'b; a \<noteq> idle_thread s'; idle_thread s'b = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; get_tcb a s'b = Some obj'; get_etcb a s'b = Some etcb\<rbrakk> \<Longrightarrow> (tcb_pending_op_slot = tcb_boundntfn_slot \<longrightarrow> ((case infer_tcb_bound_notification (tcb_bound_notification obj') of PendingSyncSendCap x badge xa xb xc xd \<Rightarrow> Some badge | _ \<Rightarrow> None) = Some (sender_badge pl) \<longrightarrow> (x = a \<longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')] = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_boundntfn_slot \<mapsto> RestartCap]) \<and> (x \<noteq> a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) (if ptr = a then Some (TCB (update_tcb_state Restart obj')) else (kheap s'b |` (- {idle_thread s'} - {a})) ptr))) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) ((kheap s'b |` (- {idle_thread s'})) ptr))) x)) \<and> ((case infer_tcb_bound_notification (tcb_bound_notification obj') of PendingSyncSendCap x badge xa xb xc xd \<Rightarrow> Some badge | _ \<Rightarrow> None) \<noteq> Some (sender_badge pl) \<longrightarrow> (x = a \<longrightarrow> Some (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'b) a obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>) = cdl_objects (transform s'b) a) \<and> (x \<noteq> a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) (if ptr = a then Some (TCB (update_tcb_state Restart obj')) else (kheap s'b |` (- {idle_thread s'} - {a})) ptr))) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) ((kheap s'b |` (- {idle_thread s'})) ptr))) x))) \<and> (tcb_pending_op_slot \<noteq> tcb_boundntfn_slot \<longrightarrow> (x = a \<longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> RestartCap, tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')] = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj'), tcb_pending_op_slot \<mapsto> RestartCap]) \<and> (x \<noteq> a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) (if ptr = a then Some (TCB (update_tcb_state Restart obj')) else (kheap s'b |` (- {idle_thread s'} - {a})) ptr))) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s'b) ptr ((ekheap s'b |` (- {idle_thread s'})) ptr)) ((kheap s'b |` (- {idle_thread s'})) ptr))) x))
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 7. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 9. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 10. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R220 s' x2 a s'a obj' pl s'b obj'a) (?R'220 s' x2 a s'a obj' pl s'b obj'a) (return ()) (do x <- set_thread_state_ext a;
y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 7. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 10. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (\<lambda>x. True) (\<lambda>x. True) (return ()) (do y <- tcb_sched_action tcb_sched_enqueue a;
return (a, False)
od)
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 7. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 10. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (\<lambda>y. True) (\<lambda>y. True) (return ()) (return (a, False))
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 3. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 4. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 5. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 6. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 7. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 8. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 10. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some (sender_badge pl) then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>) \<lbrace>\<lambda>x. ?R220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 2. \<And>s' x2 a s'a obj' pl s'b obj'a. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> KHeap_A.set_object a (TCB (update_tcb_state Restart obj'a)) \<lbrace>\<lambda>x. ?R'220 s' x2 a s'a obj' pl s'b obj'a\<rbrace>
 3. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; transform s'b = s\<rbrakk> \<Longrightarrow> ((=) (transform s'b) and (\<lambda>_. True)) s
 4. \<And>s' x2 a s'a obj' pl s'b obj'a s. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl; word2 = sender_badge pl; s'a = s'b; get_tcb a s'b = Some obj'a; transform s'a = transform s'b; s'b = s\<rbrakk> \<Longrightarrow> ((=) s'b and (\<lambda>_. True)) s
 5. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 6. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 9. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 10. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
A total of 19 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; kheap s'a a = Some (TCB obj'); tcb_state obj' = BlockedOnSend epptr pl\<rbrakk> \<Longrightarrow> sender_badge pl \<noteq> word2 \<longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (modify (\<lambda>s. s\<lparr>cdl_objects := \<lambda>x. if x = a then case cdl_objects s a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects s x else cdl_objects s x\<rparr>)) (return (a, True))
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; get_tcb a s'a = Some obj'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); transform_current_thread s' = transform_current_thread (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2\<rbrakk> \<Longrightarrow> transform_objects s'a = (\<lambda>x. if x = a then case transform_objects s'a a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> x else transform_objects s'a x)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl x. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; get_tcb a s'a = Some obj'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); transform_current_thread s' = transform_current_thread (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2\<rbrakk> \<Longrightarrow> transform_objects s'a x = (if x = a then case transform_objects s'a a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> x else transform_objects s'a x)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; get_tcb a s'a = Some obj'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); transform_current_thread s' = transform_current_thread (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2; get_etcb a s'a = Some etcb\<rbrakk> \<Longrightarrow> transform_objects s'a a = (case transform_objects s'a a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> a)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; get_tcb a s'a = Some obj'; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); transform_current_thread s' = transform_current_thread (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2; get_etcb a s'a = Some etcb; a \<noteq> idle_thread s'a\<rbrakk> \<Longrightarrow> transform_objects s'a a = (case transform_objects s'a a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> a)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); transform_current_thread s' = transform_current_thread (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2; get_etcb a s'a = Some etcb; a \<noteq> idle_thread s'a; transform_objects s'a a = Some (transform_tcb (machine_state s'a) a obj' etcb)\<rbrakk> \<Longrightarrow> transform_objects s'a a = (case transform_objects s'a a of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> a)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' x2 a s'a obj' pl etcb. \<lbrakk>valid_state s'; valid_etcbs s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); valid_ep (SendEP x2) s'; a \<in> set x2; valid_idle s'a; valid_etcbs s'a; not_idle_thread a s'a; idle_thread s'a = idle_thread s'; tcb_state obj' = BlockedOnSend epptr pl; transform_objects s' = transform_objects (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); sender_badge pl \<noteq> word2; get_etcb a s'a = Some etcb; a \<noteq> idle_thread s'; transform_objects s'a a = Some (transform_tcb (machine_state s'a) a obj' etcb)\<rbrakk> \<Longrightarrow> Some (transform_tcb (machine_state s'a) a obj' etcb) = (case transform_tcb (machine_state s'a) a obj' etcb of Tcb tcb \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s'a, cdl_cdt = transform_cdt s'a, cdl_current_thread = transform_current_thread s'a, cdl_irq_node = interrupt_irq_node s'a, cdl_asid_table = transform_asid_table s'a, cdl_current_domain = cur_domain s'a\<rparr> a)
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 10. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; True\<rbrakk> \<Longrightarrow> True
 2. \<And>s' x2 a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); a \<in> set x2; ?P91 s' x2 (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') a s\<rbrakk> \<Longrightarrow> valid_idle s \<and> valid_etcbs s \<and> not_idle_thread a s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) a s
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>?P91 s' x2 s'a y\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv. ?P91 s' x2 s'a y\<rbrace>
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. ?P91 s' x2 s'a x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. \<forall>y\<in>set x2. x \<noteq> y \<longrightarrow> \<lbrace>\<lambda>a. valid_idle a \<and> valid_etcbs a \<and> not_idle_thread y a \<and> idle_thread a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y a\<rbrace> do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od \<lbrace>\<lambda>rv a. valid_idle a \<and> valid_etcbs a \<and> not_idle_thread y a \<and> idle_thread a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y a\<rbrace>
 2. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 7. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 8. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' x2 x y. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. valid_idle a \<and> valid_etcbs a \<and> y \<noteq> idle_thread a \<and> idle_thread a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y a\<rbrace> do xa <- get_thread_state x;
v <- if blocking_ipc_badge xa = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True;
return (x, v)
od \<lbrace>\<lambda>rv a. valid_idle a \<and> valid_etcbs a \<and> y \<noteq> idle_thread a \<and> idle_thread a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y a\<rbrace>
 2. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 7. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 8. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 x y. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y\<rbrakk> \<Longrightarrow> \<lbrace>?Q579 s' x2 x y\<rbrace> get_thread_state x \<lbrace>\<lambda>xa s. (blocking_ipc_badge xa = word2 \<longrightarrow> (valid_idle and (\<lambda>s. x = idle_thread s \<longrightarrow> idle Restart)) s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> (st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y and K (y \<noteq> x)) s) \<and> (blocking_ipc_badge xa \<noteq> word2 \<longrightarrow> valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s)\<rbrace>
 2. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> ?Q579 s' x2 x y s
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' x2 x y. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y\<rbrakk> \<Longrightarrow> \<lbrace>?Q579 s' x2 x y\<rbrace> get_thread_state x \<lbrace>\<lambda>r a. valid_idle a \<and> idle_thread a = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y a \<and> y \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace>
 2. \<And>s' x2 x y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (blocking_ipc_badge rv = word2 \<longrightarrow> (valid_idle and (\<lambda>s. x = idle_thread s \<longrightarrow> idle Restart)) s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> (st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y and K (y \<noteq> x)) s) \<and> (blocking_ipc_badge rv \<noteq> word2 \<longrightarrow> valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s)
 3. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> ?Q579 s' x2 x y s
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 8. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 9. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 10. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 x y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (blocking_ipc_badge rv = word2 \<longrightarrow> (valid_idle and (\<lambda>s. x = idle_thread s \<longrightarrow> idle Restart)) s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> (st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y and K (y \<noteq> x)) s) \<and> (blocking_ipc_badge rv \<noteq> word2 \<longrightarrow> valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s)
 2. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' x2 y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv\<rbrakk> \<Longrightarrow> valid_idle s'
 2. \<And>s' x2 y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv\<rbrakk> \<Longrightarrow> ?a624 s' x2 y rv s \<in> set (?list624 s' x2 y rv s)
 3. \<And>s' x2 y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (SendEP (?list624 s' x2 y rv s))) (?epptr624 s' x2 y rv s) s'
 4. \<And>s' x2 y rv s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv; not_idle_thread (?a624 s' x2 y rv s) s'\<rbrakk> \<Longrightarrow> False
 5. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s
 6. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 7. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 8. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 9. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 10. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
A total of 16 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' x2 y rv s. \<lbrakk>valid_pspace s' \<and> valid_mdb s' \<and> valid_ioc s' \<and> valid_idle s' \<and> only_idle s' \<and> if_unsafe_then_cap s' \<and> valid_reply_caps s' \<and> valid_reply_masters s' \<and> valid_global_refs s' \<and> valid_arch_state s' \<and> valid_irq_node s' \<and> valid_irq_handlers s' \<and> valid_irq_states s' \<and> valid_machine_state s' \<and> valid_vspace_objs s' \<and> valid_arch_caps s' \<and> valid_global_objs s' \<and> valid_kernel_mappings s' \<and> equal_kernel_mappings s' \<and> valid_asid_map s' \<and> valid_global_vspace_mappings s' \<and> pspace_in_kernel_window s' \<and> cap_refs_in_kernel_window s' \<and> pspace_respects_device_region s' \<and> cap_refs_respects_device_region s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); idle_thread s' \<in> set x2; y \<in> set x2; valid_idle s; idle_thread s = idle_thread s'; st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s; y \<noteq> idle_thread s'; valid_etcbs s; word2 = blocking_ipc_badge rv; not_idle_thread (idle_thread s') s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 7. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 8. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 9. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' x2 x y s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); x \<in> set x2; y \<in> set x2; x \<noteq> y; valid_idle s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s\<rbrakk> \<Longrightarrow> valid_idle s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) y s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s
 2. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 6. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 7. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 8. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; transform s'a = s\<rbrakk> \<Longrightarrow> True
 2. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 6. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 7. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 10. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; s'a = s; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x2. valid_idle s \<and> valid_etcbs s \<and> not_idle_thread x s \<and> idle_thread s = idle_thread s' \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x s
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> valid_idle (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s') \<and> st_tcb_at (\<lambda>ts. \<exists>pl. ts = BlockedOnSend epptr pl) x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_state s'; valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> x \<noteq> epptr \<and> (x \<noteq> epptr \<longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_state s'; valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload\<rbrakk> \<Longrightarrow> x \<noteq> epptr \<longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr\<rbrakk> \<Longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (11 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr\<rbrakk> \<Longrightarrow> st_tcb_at generates_pending x s'
 2. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; not_idle_thread x s'\<rbrakk> \<Longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 6. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 7. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 10. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; not_idle_thread x s'\<rbrakk> \<Longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (11 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; not_idle_thread x s'\<rbrakk> \<Longrightarrow> ep_at (?epptr705 s' x2 x t payload) s'
 2. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; not_idle_thread x s'; not_idle_thread (?epptr705 s' x2 x t payload) s'\<rbrakk> \<Longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 5. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 6. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 7. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 10. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; not_idle_thread x s'; not_idle_thread epptr s'\<rbrakk> \<Longrightarrow> idle_thread s' \<noteq> epptr \<and> (idle_thread s' \<noteq> epptr \<longrightarrow> (\<exists>ko. kheap s' (idle_thread s') = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> idle (tcb_state tcb) \<and> tcb_bound_notification tcb = None \<and> valid_arch_idle (tcb_iarch tcb))) \<and> idle_thread s' = idle_thread_ptr \<and> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) \<and> not_idle_thread x (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'))
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload tcb. \<lbrakk>valid_etcbs s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; x \<noteq> idle_thread_ptr; epptr \<noteq> idle_thread_ptr; idle_thread s' = idle_thread_ptr; kheap s' idle_thread_ptr = Some (TCB tcb); idle (tcb_state tcb); tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb)\<rbrakk> \<Longrightarrow> valid_etcbs_2 (ekheap s') (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a)
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload tcb ptr. \<lbrakk>\<forall>ptr. st_tcb_at (\<lambda>_. True) ptr s' = is_etcb_at ptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; x \<noteq> idle_thread_ptr; epptr \<noteq> idle_thread_ptr; idle_thread s' = idle_thread_ptr; kheap s' idle_thread_ptr = Some (TCB tcb); idle (tcb_state tcb); tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb)\<rbrakk> \<Longrightarrow> st_tcb_at_kh (\<lambda>_. True) ptr (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) = is_etcb_at ptr s'
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 x t payload tcb ptr. \<lbrakk>valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnSend epptr payload)}; none_is_receiving_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; kheap s' x = Some (TCB t); tcb_state t = BlockedOnSend epptr payload; valid_pspace s'; valid_mdb s'; valid_ioc s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; x \<noteq> epptr; x \<noteq> idle_thread_ptr; epptr \<noteq> idle_thread_ptr; idle_thread s' = idle_thread_ptr; kheap s' idle_thread_ptr = Some (TCB tcb); idle (tcb_state tcb); tcb_bound_notification tcb = None; valid_arch_idle (tcb_iarch tcb); st_tcb_at (\<lambda>_. True) ptr s' = is_etcb_at ptr s'\<rbrakk> \<Longrightarrow> st_tcb_at_kh (\<lambda>_. True) ptr (\<lambda>a. if a = epptr then Some (kernel_object.Endpoint IdleEP) else kheap s' a) = is_etcb_at ptr s'
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 4. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (9 subgoals):
 1. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) (transform s'a)\<rbrace> tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} (\<lambda>x. case x of Some (Tcb tcb) \<Rightarrow> if get_tcb_ep_badge tcb = Some word2 then Some (Tcb (remove_pending_operation tcb RestartCap)) else x) \<lbrace>?Q80 s' x2 s'a\<rbrace>
 2. \<And>s' x2 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> mapM (\<lambda>x. do v <- do st <- get_thread_state x;
if blocking_ipc_badge st = word2 then do y <- set_thread_state x Restart;
y <- tcb_sched_action tcb_sched_enqueue x;
return False
od else return True
od;
return (x, v)
od) x2 \<lbrace>?Q'80 s' x2 s'a\<rbrace>
 3. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (?Q80 s' x2 s'a x) (?Q'80 s' x2 s'a ys) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 4. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 5. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 8. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x2 s'a x ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform s'a; s'a = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'; dc x ys\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>s. True) (\<lambda>s. True) (return x) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x2 ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>s. True) (\<lambda>s. True) (return ()) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 3. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (9 subgoals):
 1. \<And>s' x2 ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')\<rbrakk> \<Longrightarrow> dcorres dc (?Q1013 s' x2 ys) (?Q'1013 s' x2 ys) (return ()) (do y <- set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys)));
reschedule_required
od)
 2. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ?Q1013 s' x2 ys s
 3. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ?Q'1013 s' x2 ys s
 4. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 5. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 8. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (10 subgoals):
 1. \<And>s' x2 ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')\<rbrakk> \<Longrightarrow> dcorres dc (?R1017 s' x2 ys) (?R'1017 s' x2 ys) (return ()) reschedule_required
 2. \<And>s' x2 ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1017 s' x2 ys\<rbrace> set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys))) \<lbrace>\<lambda>x. ?R'1017 s' x2 ys\<rbrace>
 3. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1017 s' x2 ys) s
 4. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'1017 s' x2 ys) s
 5. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 6. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 8. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 9. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (9 subgoals):
 1. \<And>s' x2 ys. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s')\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1017 s' x2 ys\<rbrace> set_endpoint epptr (case map fst (filter snd ys) of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP (map fst (filter snd ys))) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True)) s
 3. \<And>s' x2 ys s. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'; transform s' = transform (update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'1017 s' x2 ys) s
 4. \<And>s' rv x2 s s'a. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'a\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. s = update_kheap ((kheap s')(epptr \<mapsto> kernel_object.Endpoint IdleEP)) s'\<rbrace>
 5. \<And>s' rv x2 s s'a cs. \<lbrakk>valid_state s'; valid_etcbs s'; rv = SendEP x2; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint (SendEP x2)) epptr and valid_ep (SendEP x2)) s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 8. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (5 subgoals):
 1. \<And>s' x2 cs. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr IdleEP \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 4. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (5 subgoals):
 1. \<And>s' x2 cs. \<lbrakk>valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep (SendEP x2) s'\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>_. True) (return (?x1061 s' x2 cs)) (set_endpoint epptr IdleEP)
 2. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 4. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (4 subgoals):
 1. \<And>s' rv x3. \<lbrakk>valid_state s'; valid_etcbs s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr and valid_ep rv) (CSpace_D.cancel_badged_sends epptr word2) (case rv of SendEP queue \<Rightarrow> do y <- set_endpoint epptr IdleEP;
queue' <- filterM (\<lambda>t. do st <- get_thread_state t;
if blocking_ipc_badge st = word2 then do y <- set_thread_state t Restart;
y <- tcb_sched_action tcb_sched_enqueue t;
return False
od else return True
od) queue;
y <- set_endpoint epptr (case queue' of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> SendEP queue');
reschedule_required
od | _ \<Rightarrow> return ())
 2. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 3. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (4 subgoals):
 1. \<And>s' x3. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) (do s <- get;
tcb_filter_modify {x. \<exists>tcb. cdl_objects s x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr \<and> get_tcb_ep_badge tcb = Some word2} (case_option undefined (case_cdl_object undefined undefined (\<lambda>tcb. Some (Tcb (remove_pending_operation tcb RestartCap))) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) undefined (\<lambda>a. undefined)))
od) (return ())
 2. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 3. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (4 subgoals):
 1. \<And>s' x3 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (tcb_filter_modify {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr \<and> get_tcb_ep_badge tcb = Some word2} (case_option undefined (case_cdl_object undefined undefined (\<lambda>tcb. Some (Tcb (remove_pending_operation tcb RestartCap))) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) (\<lambda>a. undefined) undefined (\<lambda>a. undefined)))) (return ())
 2. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 3. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr \<and> get_tcb_ep_badge tcb = Some word2} = {}
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr \<and> get_tcb_ep_badge tcb = Some word2} = {}
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 s'a. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; valid_ep_abstract (RecvEP x3) epptr s'; {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = get_waiting_sync_recv_threads epptr (transform s'a) \<union> get_waiting_sync_send_threads epptr (transform s'a) \<union> get_waiting_ntfn_recv_threads epptr (transform s'a)\<rbrakk> \<Longrightarrow> {x. \<exists>tcb. cdl_objects (transform s'a) x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr \<and> get_tcb_ep_badge tcb = Some word2} = {}
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; valid_ep_abstract (RecvEP x3) epptr s'; {x. \<exists>tcb. cdl_objects (transform s') x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr} = get_waiting_sync_recv_threads epptr (transform s') \<union> get_waiting_sync_send_threads epptr (transform s') \<union> get_waiting_ntfn_recv_threads epptr (transform s'); ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_state s'; valid_etcbs s'; valid_ep_abstract (RecvEP x3) epptr s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; (x \<in> {x. \<exists>tcb. cdl_objects (transform s') x = Some (Tcb tcb) \<and> is_thread_blocked_on_endpoint tcb epptr}) = (x \<in> get_waiting_sync_recv_threads epptr (transform s') \<union> get_waiting_sync_send_threads epptr (transform s') \<union> get_waiting_ntfn_recv_threads epptr (transform s'))\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; x \<in> get_waiting_sync_recv_threads epptr (transform s') \<or> x \<in> get_waiting_sync_send_threads epptr (transform s') \<or> x \<in> get_waiting_ntfn_recv_threads epptr (transform s'); valid_pspace s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; x \<in> ep_waiting_set_recv epptr s' \<or> x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (7 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; x \<in> ep_waiting_set_recv epptr s' \<or> x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'\<rbrakk> \<Longrightarrow> valid_objs s'
 2. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; x \<in> ep_waiting_set_recv epptr s' \<or> x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}\<rbrakk> \<Longrightarrow> False
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 6. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; cdl_objects (transform s') x = Some (Tcb tcb); get_tcb_ep_badge tcb = Some word2; x \<in> ep_waiting_set_recv epptr s' \<or> x \<in> ntfn_waiting_set epptr s'; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; get_tcb_ep_badge tcb = Some word2; x \<in> ep_waiting_set_recv epptr s'; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = ep_waiting_set_recv epptr s'; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}; (\<exists>z. (if x \<noteq> idle_thread s' then kheap s' x else None) = Some z \<and> transform_object (machine_state s') x (if x \<noteq> idle_thread s' then ekheap s' x else None) z = Tcb tcb) \<or> (if x \<noteq> idle_thread s' then kheap s' x else None) = None \<and> (if x \<noteq> idle_thread s' then Some cdl_object.Untyped else None) = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb t payload. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; get_tcb_ep_badge tcb = Some word2; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)}; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}; x \<noteq> idle_thread s'; tcb_state t = BlockedOnReceive epptr payload; (case ekheap s' x of Some xa \<Rightarrow> transform_tcb (machine_state s') x t xa) = Tcb tcb; get_tcb x s' = Some t\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x tcb t payload. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; is_thread_blocked_on_endpoint tcb epptr; get_tcb_ep_badge tcb = Some word2; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)}; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}; x \<noteq> idle_thread s'; tcb_state t = BlockedOnReceive epptr payload; (case ekheap s' x of Some xa \<Rightarrow> transform_tcb (machine_state s') x t xa) = Tcb tcb; get_tcb x s' = Some t; \<exists>etcb. get_etcb x s' = Some etcb\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (6 subgoals):
 1. \<And>s' x3 x t payload etcb. \<lbrakk>valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep (RecvEP x3) s'; get_tcb_ep_badge \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable t), Suc 0 \<mapsto> transform_cap (tcb_vtable t), 2 \<mapsto> transform_cap (tcb_reply t), 3 \<mapsto> transform_cap (tcb_caller t), 4 \<mapsto> transform_cap (tcb_ipcframe t), 5 \<mapsto> PendingSyncRecvCap epptr False (receiver_can_grant payload), 6 \<mapsto> case tcb_bound_notification t of None \<Rightarrow> cdl_cap.NullCap | Some x \<Rightarrow> BoundNotificationCap x], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler t), cdl_tcb_intent = transform_full_intent (machine_state s') x t, cdl_tcb_has_fault = \<exists>y. tcb_fault t = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> = Some word2; valid_pspace s'; valid_mdb s'; x3 \<noteq> []; valid_ioc s'; set x3 = {tcb. \<exists>t. kheap s' tcb = Some (TCB t) \<and> (\<exists>payload. tcb_state t = BlockedOnReceive epptr payload)}; valid_idle s'; ep_waiting_set_send epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; ntfn_waiting_set epptr s' = {}; x \<noteq> idle_thread s'; tcb_state t = BlockedOnReceive epptr payload; kheap s' x = Some (TCB t); ekheap s' x = Some etcb\<rbrakk> \<Longrightarrow> False
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 4. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 5. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (5 subgoals):
 1. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; transform s'a = s\<rbrakk> \<Longrightarrow> True
 2. \<And>s' x3 s'a s. \<lbrakk>valid_state s'; valid_etcbs s'; transform s' = transform s'a; ((=) s' and ko_at (kernel_object.Endpoint (RecvEP x3)) epptr and valid_ep (RecvEP x3)) s'a; s'a = s\<rbrakk> \<Longrightarrow> True
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 4. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr and valid_ep r\<rbrace>
 2. \<And>s' s. \<lbrakk>valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s'. \<lbrakk>valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr) proof (prove)
goal:
No subgoals!