theory Ipc_DR

lemma send_sync_ipc_corres:
  "\<lbrakk>ep_id = epptr;tcb_id_sender= thread\<rbrakk> \<Longrightarrow>
    dcorres dc
     \<top>
  (not_idle_thread thread and (\<lambda>s. not_idle_thread (cur_thread s) s)
      and st_tcb_at active thread
      and valid_state and valid_etcbs)
     (Endpoint_D.send_ipc block call badge can_grant can_grant_reply tcb_id_sender ep_id)
     (Ipc_A.send_ipc block call badge can_grant can_grant_reply thread epptr)" apply (clarsimp simp:gets_def Endpoint_D.send_ipc_def Ipc_A.send_ipc_def
                  split del:if_split) apply (rule dcorres_absorb_get_l) apply (clarsimp split del:if_split) apply (rule_tac Q' = "\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr" in corres_symb_exec_r[rotated]) apply (wp get_simple_ko_ko_at |simp split del:if_split)+ apply (rule dcorres_expand_pfx) apply (clarsimp split del:if_split) apply (frule_tac get_endpoint_pick) apply (simp add:obj_at_def) apply (case_tac rv) apply (clarsimp split del:if_split) apply (subst ep_waiting_set_recv_lift) apply (simp add:valid_state_def) apply simp apply (clarsimp simp:valid_ep_abstract_def none_is_receiving_ep_def option_select_def) apply (rule corres_dummy_return_l) apply (rule corres_guard_imp) apply (rule corres_split[OF set_thread_state_block_on_send_corres corres_dummy_set_sync_ep]) apply wp apply simp apply (wp TrueI |clarsimp simp: split del:if_split)+ 
(* SendEP *)
    apply (subst ep_waiting_set_recv_lift) apply (simp add:valid_state_def) apply simp apply (clarsimp simp:valid_ep_abstract_def none_is_receiving_ep_def option_select_def) apply (rule corres_dummy_return_l) apply (rule corres_guard_imp) apply (rule corres_split[OF set_thread_state_block_on_send_corres corres_dummy_set_sync_ep]) apply wp apply simp apply (wp TrueI|clarsimp simp: split del:if_split)+ 
(* RecvEP *)
   apply (subst ep_waiting_set_recv_lift,simp add:valid_state_def) apply simp apply (clarsimp simp:valid_ep_abstract_def split del:if_split) apply (subst option_select_not_empty) apply (clarsimp simp: dest!: not_empty_list_not_empty_set) apply (rename_tac list) apply (drule_tac s = "set list" in sym) apply (clarsimp simp: bind_assoc neq_Nil_conv split del:if_split) apply (rule_tac P1="\<top>" and P'="(=) s'" and x1 = y
         in dcorres_absorb_pfx[OF select_pick_corres[OF dcorres_expand_pfx]]) defer apply (simp+)[3] apply (simp split del:if_split) apply (drule_tac x1 = y in iffD2[OF eqset_imp_iff], simp) apply (clarsimp simp:obj_at_def dc_def[symmetric] split del:if_split) apply (subst when_def)+ apply (rule corres_guard_imp) apply (rule dcorres_symb_exec_r) apply (simp only: liftM_def) apply (rule corres_split[OF dcorres_get_thread_state]) apply (clarsimp, rename_tac recv_state') apply (case_tac recv_state'; simp add: corres_free_fail split del: if_split) apply (rule corres_split) apply (rule corres_complete_ipc_transfer; simp) apply (rule corres_split[OF set_thread_state_corres]) apply (rule dcorres_rhs_noop_above[OF possible_switch_to_dcorres]) apply (rule dcorres_if_rhs) apply (rule dcorres_if_rhs) apply (clarsimp simp only: if_True) apply (rule corres_alternate1)+ apply (rule corres_setup_caller_cap) apply (clarsimp simp:ep_waiting_set_recv_def pred_tcb_at_def obj_at_def generates_pending_def) apply (rule corres_alternate1[OF corres_alternate2]) apply (rule set_thread_state_corres) apply (rule corres_alternate2) apply (rule corres_return_trivial) apply wp apply (rule_tac Q="\<lambda>r. valid_mdb and valid_idle and valid_objs
                          and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y
                          and st_tcb_at runnable thread and valid_etcbs"
                          in hoare_strengthen_post[rotated]) apply (clarsimp simp:pred_tcb_at_def obj_at_def,
                    simp split:Structures_A.thread_state.splits, fastforce) apply ((wp sts_st_tcb_at' sts_st_tcb_at_neq |clarsimp simp add:not_idle_thread_def)+) apply (wp hoare_vcg_conj_lift) apply (rule hoare_disjI1) apply (wp do_ipc_transfer_pred_tcb | wpc | simp)+ apply (clarsimp simp:conj_comms not_idle_thread_def) apply (wp | wps)+ apply (simp add:not_idle_thread_def) apply (clarsimp simp:ep_waiting_set_recv_def obj_at_def st_tcb_at_def)+ apply (frule_tac a = "y" and list = "y # ys" in pending_thread_in_recv_not_idle) apply (simp add:valid_state_def) apply (fastforce simp:obj_at_def) apply (simp add:insertI1 not_idle_thread_def)+ apply (rule dcorres_to_wp[where Q=\<top> ,simplified]) apply (rule corres_dummy_set_sync_ep) apply simp apply (clarsimp simp:valid_state_def not_idle_thread_def
                       valid_pspace_def st_tcb_at_def obj_at_def is_ep_def) apply (drule(1) valid_objs_valid_ep_simp) apply (clarsimp simp:valid_ep_def tcb_at_def
    valid_idle_def pred_tcb_at_def obj_at_def
    dest!:get_tcb_SomeD
    split:Structures_A.endpoint.splits list.splits) apply (clarsimp simp:ep_waiting_set_recv_def runnable_eq_active) apply (intro conjI impI) apply clarsimp+ apply fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ep_id = epptr; tcb_id_sender = thread\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (not_idle_thread thread and (\<lambda>s. not_idle_thread (cur_thread s) s) and st_tcb_at active thread and valid_state and valid_etcbs) (Endpoint_D.send_ipc block call badge can_grant can_grant_reply tcb_id_sender ep_id) (Ipc_A.send_ipc block call badge can_grant can_grant_reply thread epptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ep_id = epptr; tcb_id_sender = thread\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (not_idle_thread thread and (\<lambda>s. not_idle_thread (cur_thread s) s) and st_tcb_at active thread and valid_state and valid_etcbs) (do s <- get;
option_select (get_waiting_sync_recv_threads epptr s) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)
od) (do ep <- get_endpoint epptr;
case ep of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive
od
od) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; True; (not_idle_thread thread and (\<lambda>s. not_idle_thread (cur_thread s) s) and st_tcb_at active thread and valid_state and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (do ep <- get_endpoint epptr;
case ep of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do set_endpoint epptr $ case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue;
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
set_thread_state dest Running;
do_extended_op (possible_switch_to dest);
when call $ if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive
od
od) proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (get_endpoint epptr >>= case_endpoint (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return ()) (\<lambda>queue. case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return ()) (case_list fail (\<lambda>dest queue. do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od))) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s' and ko_at (kernel_object.Endpoint r) epptr\<rbrace>
 2. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_endpoint epptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; False\<rbrakk> \<Longrightarrow> no_fail ((=) s') (get_endpoint epptr)
 4. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr) (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s' and ko_at (kernel_object.Endpoint rv) epptr) (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' rv s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; s = transform s'a; transform s' = s; ((=) s' and ko_at (kernel_object.Endpoint rv) epptr) s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'\<rbrakk> \<Longrightarrow> kheap s' (?epptr23 s' rv) = Some (kernel_object.Endpoint (?endpoint23 s' rv))
 2. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract (?endpoint23 s' rv) (?epptr23 s' rv) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s' rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = IdleEP\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 2. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return ())
 2. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (5 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> valid_idle s'
 2. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 3. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return ())
 4. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 5. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 2. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return ())
 3. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 4. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; valid_ep_abstract IdleEP epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return ())
 2. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False)) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP [thread])
od)
 2. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) >>= return) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP [thread])
od)
 2. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (5 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> dcorres dc (?Q42 s') (?Q'42 s') (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) >>= return) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP [thread])
od)
 2. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; transform s' = s\<rbrakk> \<Longrightarrow> ?Q42 s' s
 3. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; s' = s\<rbrakk> \<Longrightarrow> ?Q'42 s' s
 4. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 5. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (6 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q46 s'\<rbrace> block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q'46 s'\<rbrace> set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q46 s') s
 4. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'46 s') s
 5. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 6. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (5 subgoals):
 1. \<And>s'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q'46 s'\<rbrace> set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'46 s') s
 4. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 5. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 2. \<And>s' s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint IdleEP) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint IdleEP); none_is_sending_ep epptr s'; ep_waiting_set_recv epptr s' = {}; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'46 s') s
 3. \<And>s' rv x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = SendEP x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od)
 4. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [thread])
od | False \<Rightarrow> return ())
 2. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [thread])
od | False \<Rightarrow> return ())
 2. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> valid_idle s'
 2. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 3. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [thread])
od | False \<Rightarrow> return ())
 4. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 2. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [thread])
od | False \<Rightarrow> return ())
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; valid_ep_abstract (SendEP x2) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (x2 @ [thread])
od | False \<Rightarrow> return ())
 2. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False)) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (x2 @ [thread]))
od)
 2. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) >>= return) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (x2 @ [thread]))
od)
 2. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> dcorres dc (?Q121 s' x2) (?Q'121 s' x2) (block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) >>= return) (do y <- set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr (SendEP (x2 @ [thread]))
od)
 2. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; transform s' = s\<rbrakk> \<Longrightarrow> ?Q121 s' x2 s
 3. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; s' = s\<rbrakk> \<Longrightarrow> ?Q'121 s' x2 s
 4. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (5 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 s' x2\<rbrace> block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 s' x2\<rbrace> set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q125 s' x2) s
 4. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'125 s' x2) s
 5. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s' x2. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 s' x2\<rbrace> set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'125 s' x2) s
 4. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (3 subgoals):
 1. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 2. \<And>s' x2 s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (SendEP x2)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (SendEP x2)); x2 \<noteq> []; set x2 = ep_waiting_set_send epptr s'; ep_waiting_set_recv epptr s' = {}; \<forall>p'. Some (kernel_object.Endpoint (SendEP x2)) = kheap s' p' \<longrightarrow> epptr = p'; block; s' = s\<rbrakk> \<Longrightarrow> (not_idle_thread thread and valid_etcbs and ?Q'125 s' x2) s
 3. \<And>s' rv x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint rv) epptr s'; valid_ep_abstract rv epptr s'; rv = RecvEP x3\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case rv of IdleEP \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP [thread]
od | False \<Rightarrow> return () | SendEP queue \<Rightarrow> case block of True \<Rightarrow> do set_thread_state thread (BlockedOnSend epptr \<lparr>sender_badge = badge, sender_can_grant = can_grant, sender_can_grant_reply = can_grant_reply, sender_is_call = call\<rparr>);
set_endpoint epptr $ SendEP (queue @ [thread])
od | False \<Rightarrow> return () | RecvEP [] \<Rightarrow> fail | RecvEP (dest # queue) \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (get_waiting_sync_recv_threads epptr (transform s')) >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 2. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; valid_ep_abstract (RecvEP x3) epptr s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv epptr s'; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (option_select (ep_waiting_set_recv epptr s') >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv epptr s'; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> ep_waiting_set_recv epptr s' \<noteq> {}
 2. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv epptr s'; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do a <- select (ep_waiting_set_recv epptr s');
return (Some a)
od >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' x3. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP x3)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP x3)); x3 \<noteq> []; set x3 = ep_waiting_set_recv epptr s'; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP x3)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do a <- select (ep_waiting_set_recv epptr s');
return (Some a)
od >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case x3 of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' list. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP list)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP list)); list \<noteq> []; set list = ep_waiting_set_recv epptr s'; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP list)) = kheap s' p' \<longrightarrow> epptr = p'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do a <- select (ep_waiting_set_recv epptr s');
return (Some a)
od >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' list. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP list)) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP list)); list \<noteq> []; none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP list)) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = set list\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do a <- select (ep_waiting_set_recv epptr s');
return (Some a)
od >>= case_option (if block then block_thread_on_ipc thread (PendingSyncSendCap epptr badge call can_grant can_grant_reply False) else return ()) (\<lambda>tcb_id_receiver. do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread tcb_id_receiver);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread tcb_id_receiver can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (tcb_id_receiver, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread tcb_id_receiver reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od)) (case list of [] \<Rightarrow> fail | dest # queue \<Rightarrow> do y <- set_endpoint epptr (case queue of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP queue);
recv_state <- get_thread_state dest;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant dest;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
y <- set_thread_state dest Running;
y <- possible_switch_to dest;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread dest reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do a <- select (insert y (set ys));
recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread a);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread a can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
y <- KHeap_D.set_cap (a, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread a reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (4 subgoals):
 1. \<And>s' y ys s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys); s = transform s'a; True; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od)
 2. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> transform s' = transform s'
 3. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. y \<in> insert y (set ys))) (transform s')
 4. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> s' = s' proof (prove)
goal (4 subgoals):
 1. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> transform s' = transform s'
 2. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. y \<in> insert y (set ys))) (transform s')
 3. \<And>s' y ys. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys)\<rbrakk> \<Longrightarrow> s' = s'
 4. \<And>s' y ys s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys); s = transform s'a; True; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y ys s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'; not_idle_thread (cur_thread s') s'; st_tcb_at active thread s'; valid_state s'; valid_etcbs s'; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'; kheap s' epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s' p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s' = insert y (set ys); s = transform s'a; True; s' = s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y ys s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; ep_waiting_set_recv epptr s'a = insert y (set ys); s = transform s'a; s' = s'a\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>s' y ys s s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; ko_at (kernel_object.Endpoint (RecvEP (y # ys))) epptr s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; s = transform s'a; s' = s'a; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) ((=) (transform s'a)) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
when (can_grant \<or> can_grant_reply) (inject_reply_cap thread y reply_can_grant) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
when call (if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive)
od) proof (prove)
goal (1 subgoal):
 1. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od) proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc (?Q216 y ys s'a) (?Q'216 y ys s'a) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys);
recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q216 y ys s'a s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (5 subgoals):
 1. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc (?Q216 y ys s'a) (?Q'220 y ys s'a rv) (do recv_state <- liftM (\<lambda>tcb. the (cdl_tcb_caps tcb tcb_pending_op_slot)) (get_thread y);
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>?Q'220 y ys s'a\<rbrace>
 3. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q216 y ys s'a s
 5. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (5 subgoals):
 1. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc (?Q216 y ys s'a) (?Q'220 y ys s'a rv) (do recv_state <- do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od;
reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do recv_state <- get_thread_state y;
reply_can_grant <- case recv_state of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>?Q'220 y ys s'a\<rbrace>
 3. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q216 y ys s'a s
 5. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (7 subgoals):
 1. \<And>y ys s'a rv recv_state recv_statea. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state = infer_tcb_pending_op y recv_statea\<rbrakk> \<Longrightarrow> dcorres dc (?R224 y ys s'a rv recv_state) (?R'224 y ys s'a rv recv_statea) (do reply_can_grant <- case recv_state of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do reply_can_grant <- case recv_statea of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>?R224 y ys s'a rv\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>?R'224 y ys s'a rv\<rbrace>
 4. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 5. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (7 subgoals):
 1. \<And>y ys s'a recv_state'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> dcorres dc (?R224 y ys s'a () (infer_tcb_pending_op y recv_state')) (?R'224 y ys s'a () recv_state') (do reply_can_grant <- case infer_tcb_pending_op y recv_state' of PendingSyncRecvCap target True receiver_grant \<Rightarrow> fail | PendingSyncRecvCap target False receiver_grant \<Rightarrow> do Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
return receiver_grant
od | _ \<Rightarrow> fail;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y reply_can_grant else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do reply_can_grant <- case recv_state' of BlockedOnReceive x data \<Rightarrow> do Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
return (receiver_can_grant data)
od | _ \<Rightarrow> fail;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y reply_can_grant else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>?R224 y ys s'a rv\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>?R'224 y ys s'a rv\<rbrace>
 4. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 5. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (7 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres dc (?R224 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))) (?R'224 y ys s'a () (BlockedOnReceive x41 x42)) (do ya <- Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant;
ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y;
ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>?R224 y ys s'a rv\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>?R'224 y ys s'a rv\<rbrace>
 4. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 5. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (10 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> dcorres (?r'252 y ys s'a recv_state' x41 x42) (?P263 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))) (?P'259 y ys s'a () (BlockedOnReceive x41 x42)) (Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant) (Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; ?r'252 y ys s'a recv_state' x41 x42 ya yb\<rbrakk> \<Longrightarrow> dcorres dc (?R252 y ys s'a recv_state' x41 x42 ya) (?R'252 y ys s'a recv_state' x41 x42 yb) (do ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive else return ()
od)
 3. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>?R252 y ys s'a recv_state' x41 x42\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>?R'252 y ys s'a recv_state' x41 x42\<rbrace>
 5. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. ?P263 y ys s'a rv a and ?Q261 y ys s'a rv a\<rbrace>
 6. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. ?P'259 y ys s'a rv a and ?Q'257 y ys s'a rv a\<rbrace>
 7. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 8. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 10. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (9 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> dcorres dc (?R252 y ys s'a recv_state' x41 x42 ya) (?R'252 y ys s'a recv_state' x41 x42 yb) (do ya <- KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap;
(if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()
od) (do ya <- set_thread_state y Running;
ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>?R252 y ys s'a recv_state' x41 x42\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>?R'252 y ys s'a recv_state' x41 x42\<rbrace>
 4. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 5. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 6. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 7. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 9. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (11 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R275 y ys s'a recv_state' x41 x42 ya yb rv) (?R'275 y ys s'a recv_state' x41 x42 ya yb rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (do ya <- possible_switch_to y;
if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive else return ()
od)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 6. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 7. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 8. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 9. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'286 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (if call then if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive else return ())
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_. ?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_. ?Q'286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 8. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (if can_grant \<or> can_grant_reply then setup_caller_cap thread y (receiver_can_grant x42) else set_thread_state thread Inactive)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_. ?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> ?Q291 y ys s'a recv_state' x41 x42 ya yb rv rv' s) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; can_grant \<or> can_grant_reply\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (setup_caller_cap thread y (receiver_can_grant x42))
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (set_thread_state thread Inactive)
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_. ?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> ?Q294 y ys s'a recv_state' x41 x42 ya yb rv rv' s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 9. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; dc ya yb; dc rv rv'; call; can_grant \<or> can_grant_reply\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a (BlockedOnReceive x41 x42) x41 x42 ya yb rv rv') (?Q294 y ys s'a (BlockedOnReceive x41 x42) x41 x42 ya yb rv rv') (inject_reply_cap thread y (receiver_can_grant x42) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (setup_caller_cap thread y (receiver_can_grant x42))
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (set_thread_state thread Inactive)
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_. ?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> ?Q294 y ys s'a recv_state' x41 x42 ya yb rv rv' s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 9. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; dc ya yb; dc rv rv'; call; can_grant \<or> can_grant_reply\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a (BlockedOnReceive x41 x42) x41 x42 ya yb rv rv') (?Q294 y ys s'a (BlockedOnReceive x41 x42) x41 x42 ya yb rv rv') (inject_reply_cap thread y (receiver_can_grant x42)) (setup_caller_cap thread y (receiver_can_grant x42))
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (set_thread_state thread Inactive)
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv') (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_. ?Q286 y ys s'a recv_state' x41 x42 ya yb rv rv'\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> ?Q294 y ys s'a recv_state' x41 x42 ya yb rv rv' s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 9. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; dc ya yb; dc rv rv'; call; can_grant \<or> can_grant_reply\<rbrakk> \<Longrightarrow> thread \<noteq> y
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (set_thread_state thread Inactive)
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 9. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (set_thread_state thread Inactive)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; call; \<not> (can_grant \<or> can_grant_reply)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv') (KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap) (set_thread_state thread Inactive)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> ?Q'294 y ys s'a recv_state' x41 x42 ya yb rv rv' s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 8. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') ((if can_grant \<or> can_grant_reply then inject_reply_cap thread y (receiver_can_grant x42) else return ()) \<sqinter> KHeap_D.set_cap (thread, tcb_pending_op_slot) cdl_cap.NullCap \<sqinter> return ()) (return ())
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> (not_idle_thread thread and K (cdl_cap.NullCap = infer_tcb_pending_op thread Inactive) and valid_etcbs) s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 8. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; \<not> call\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>a. True) (?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv') (return ()) (return ())
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> (not_idle_thread thread and K (cdl_cap.NullCap = infer_tcb_pending_op thread Inactive) and valid_etcbs) s)) \<and> (\<not> call \<longrightarrow> ?Q'291 y ys s'a recv_state' x41 x42 ya yb rv rv' s)\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 7. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 8. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 9. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 10. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb rv\<rbrace> return () \<lbrace>\<lambda>_ a. True\<rbrace>
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> (not_idle_thread thread and K (cdl_cap.NullCap = infer_tcb_pending_op thread Inactive) and valid_etcbs) s)) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>?R275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 7. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 8. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 9. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 10. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>_ s. (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> (not_idle_thread thread and K (cdl_cap.NullCap = infer_tcb_pending_op thread Inactive) and valid_etcbs) s)) \<and> (\<not> call \<longrightarrow> True)\<rbrace>
 2. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 6. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 7. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 8. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 9. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv' rva s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'; (valid_mdb and valid_idle and valid_objs and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at runnable thread and valid_etcbs) s\<rbrakk> \<Longrightarrow> (call \<longrightarrow> (can_grant \<or> can_grant_reply \<longrightarrow> (valid_mdb and valid_idle and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at (Not \<circ> halted) thread and valid_objs and valid_etcbs) s) \<and> (\<not> (can_grant \<or> can_grant_reply) \<longrightarrow> (not_idle_thread thread and K (cdl_cap.NullCap = infer_tcb_pending_op thread Inactive) and valid_etcbs) s)) \<and> (\<not> call \<longrightarrow> True)
 2. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>r. valid_mdb and valid_idle and valid_objs and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at runnable thread and valid_etcbs\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 6. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 7. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 8. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 9. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 10. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>y ys s'a recv_state' x41 x42 ya yb rv rv'. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb rv'\<rbrace> possible_switch_to y \<lbrace>\<lambda>r. valid_mdb and valid_idle and valid_objs and not_idle_thread thread and not_idle_thread y and tcb_at thread and tcb_at y and st_tcb_at runnable thread and valid_etcbs\<rbrace>
 2. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace> KHeap_D.set_cap (y, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>y ys s'a recv_state' x41 x42 ya yb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42; dc ya yb\<rbrakk> \<Longrightarrow> \<lbrace>?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace> set_thread_state y Running \<lbrace>?R'275 y ys s'a recv_state' x41 x42 ya yb\<rbrace>
 4. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q261 y ys s'a () (PendingSyncRecvCap x41 False (receiver_can_grant x42))\<rbrace> Endpoint_D.do_ipc_transfer (Some epptr) thread y can_grant \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q277 y ys s'a recv_state' x41 x42 ya\<rbrace>
 5. \<And>y ys s'a recv_state' x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; recv_state' = BlockedOnReceive x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>?Q'257 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>yb. not_idle_thread y and K (RunningCap = infer_tcb_pending_op y Running) and valid_etcbs and ?Q'282 y ys s'a recv_state' x41 x42 yb\<rbrace>
 6. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and ?Q261 y ys s'a rv a\<rbrace>
 7. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and ?Q'257 y ys s'a rv a\<rbrace>
 8. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 9. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>y ys s'a x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'532 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>rv s. (st_tcb_at (\<lambda>st. \<not> halted st) y s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = y) (y, tcb_cnode_index 2) s) \<and> thread \<noteq> idle_thread s \<and> y \<noteq> idle_thread s \<and> tcb_at thread s \<and> tcb_at y s \<and> st_tcb_at runnable thread s \<and> thread \<noteq> y \<and> valid_etcbs s\<rbrace>
 2. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and (\<lambda>b. y \<noteq> idle_thread b \<and> valid_etcbs b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_idle b \<and> y \<noteq> idle_thread b \<and> (valid_objs and valid_mdb) b \<and> ?P'532 y ys s'a rv a b)\<rbrace>
 4. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 5. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (8 subgoals):
 1. \<And>y ys s'a x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P539 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>rv s. st_tcb_at (\<lambda>st. \<not> halted st) y s \<or> cte_wp_at (\<lambda>c. is_master_reply_cap c \<and> obj_ref_of c = y) (y, tcb_cnode_index 2) s\<rbrace>
 2. \<And>y ys s'a x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'538 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>rv s. thread \<noteq> idle_thread s \<and> y \<noteq> idle_thread s \<and> tcb_at thread s \<and> tcb_at y s \<and> st_tcb_at runnable thread s \<and> thread \<noteq> y \<and> valid_etcbs s\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True \<and> True)\<rbrace>
 4. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and (\<lambda>b. y \<noteq> idle_thread b \<and> valid_etcbs b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_idle b \<and> y \<noteq> idle_thread b \<and> (valid_objs and valid_mdb) b \<and> ?P539 y ys s'a rv a b \<and> ?P'538 y ys s'a rv a b)\<rbrace>
 5. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 6. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 8. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (8 subgoals):
 1. \<And>y ys s'a x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P539 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>rv. st_tcb_at (\<lambda>st. \<not> halted st) y\<rbrace>
 2. \<And>y ys s'a x41 x42. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'538 y ys s'a () (BlockedOnReceive x41 x42)\<rbrace> Ipc_A.do_ipc_transfer thread (Some epptr) badge can_grant y \<lbrace>\<lambda>rv s. thread \<noteq> idle_thread s \<and> y \<noteq> idle_thread s \<and> tcb_at thread s \<and> tcb_at y s \<and> st_tcb_at runnable thread s \<and> thread \<noteq> y \<and> valid_etcbs s\<rbrace>
 3. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q226 y ys s'a\<rbrace> do x <- get_thread y;
return (the (cdl_tcb_caps x tcb_pending_op_slot))
od \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True \<and> True)\<rbrace>
 4. \<And>y ys s'a rv. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 y ys s'a rv\<rbrace> get_thread_state y \<lbrace>\<lambda>a. valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread y and not_idle_thread thread and valid_etcbs and (\<lambda>b. y \<noteq> idle_thread b \<and> valid_etcbs b \<and> (valid_mdb and (valid_objs and pspace_aligned and pspace_distinct)) b \<and> valid_idle b \<and> y \<noteq> idle_thread b \<and> (valid_objs and valid_mdb) b \<and> ?P539 y ys s'a rv a b \<and> ?P'538 y ys s'a rv a b)\<rbrace>
 5. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r. valid_etcbs and tcb_at y and not_idle_thread y and ?Q'224 y ys s'a r\<rbrace>
 6. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q226 y ys s'a) s
 8. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'216 y ys s'a s proof (prove)
goal (4 subgoals):
 1. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'598 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>rv s. not_idle_thread y s \<and> valid_objs s \<and> pspace_aligned s \<and> valid_global_refs s \<and> pspace_distinct s \<and> valid_mdb s \<and> not_idle_thread (cur_thread s) s \<and> valid_irq_node s \<and> valid_idle s \<and> not_idle_thread y s \<and> not_idle_thread thread s \<and> valid_etcbs s \<and> y \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_idle s \<and> y \<noteq> idle_thread s \<and> valid_objs s \<and> valid_mdb s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s \<and> thread \<noteq> idle_thread s \<and> y \<noteq> idle_thread s \<and> tcb_at thread s \<and> tcb_at y s \<and> st_tcb_at runnable thread s \<and> thread \<noteq> y \<and> valid_etcbs s\<rbrace>
 2. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> ?P'598 y ys s'a s proof (prove)
goal (4 subgoals):
 1. \<And>y ys s'a. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'598 y ys s'a\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>rv s. pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s\<rbrace>
 2. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> ?P'598 y ys s'a s proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a cs. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (6 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> valid_idle s'a
 2. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP (y # ys))) (?epptr654 y ys s'a cs t tcb payload) s'a
 3. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> y \<in> set (y # ys)
 4. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb); not_idle_thread y s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 6. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (5 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> ko_at (kernel_object.Endpoint (RecvEP (y # ys))) (?epptr654 y ys s'a cs t tcb payload) s'a
 2. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> y \<in> set (y # ys)
 3. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb); not_idle_thread y s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 5. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (4 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb)\<rbrakk> \<Longrightarrow> y \<in> set (y # ys)
 2. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb); not_idle_thread y s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 4. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb); y \<noteq> idle_thread s'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (3 subgoals):
 1. \<And>y ys s'a cs t tcb payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; kheap s'a thread = Some (TCB tcb); kheap s'a y = Some (TCB t); tcb_state t = BlockedOnReceive epptr payload; active (tcb_state tcb); y \<noteq> idle_thread s'a\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>_. True) (return (?x659 y ys s'a cs t tcb payload)) (set_endpoint epptr (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys))
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (2 subgoals):
 1. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 2. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (1 subgoal):
 1. \<And>y ys s'a s. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; not_idle_thread thread s'a; not_idle_thread (cur_thread s'a) s'a; st_tcb_at active thread s'a; valid_state s'a; valid_etcbs s'a; kheap s'a epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s'a; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s'a p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s'a; s'a = s\<rbrakk> \<Longrightarrow> valid_etcbs s \<and> tcb_at y s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_global_refs s \<and> (obj_at (\<lambda>ko. partial_inv kernel_object.Endpoint ko \<noteq> None) epptr and valid_idle) s \<and> (valid_irq_node and ep_at epptr) s \<and> valid_mdb s \<and> (valid_objs and valid_simple_obj (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)) and K (is_simple_type (kernel_object.Endpoint (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys)))) s \<and> thread \<noteq> y \<and> tcb_at y s \<and> tcb_at thread s \<and> y \<noteq> idle_thread s \<and> thread \<noteq> idle_thread s \<and> st_tcb_at runnable thread s \<and> valid_etcbs s \<and> cur_thread s \<noteq> idle_thread s \<and> st_tcb_at (\<lambda>a. \<not> halted a) y s proof (prove)
goal (1 subgoal):
 1. \<And>y ys s tcb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s; valid_objs s; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s y = Some ko \<and> is_tcb ko) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) s \<and> thread \<noteq> y \<and> (\<exists>ko. kheap s y = Some ko \<and> is_tcb ko) \<and> y \<noteq> idle_thread s \<and> runnable (tcb_state tcb) \<and> (\<exists>ko. kheap s y = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> \<not> halted (tcb_state tcb))) proof (prove)
goal (1 subgoal):
 1. \<And>y ys s tcb. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread s; cur_thread s \<noteq> idle_thread s; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; valid_ep (RecvEP (y # ys)) s\<rbrakk> \<Longrightarrow> (\<exists>ko. kheap s y = Some ko \<and> is_tcb ko) \<and> valid_ep (case ys of [] \<Rightarrow> IdleEP | a # list \<Rightarrow> RecvEP ys) s \<and> thread \<noteq> y \<and> (\<exists>ko. kheap s y = Some ko \<and> is_tcb ko) \<and> y \<noteq> idle_thread s \<and> runnable (tcb_state tcb) \<and> (\<exists>ko. kheap s y = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> \<not> halted (tcb_state tcb))) proof (prove)
goal (1 subgoal):
 1. \<And>y ys s tcb koa tcba. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; y \<in> ep_waiting_set_recv epptr s; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; kheap s y = Some koa; is_tcb koa; y \<notin> set ys; distinct ys; idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba)\<rbrakk> \<Longrightarrow> (ys = [] \<longrightarrow> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr \<and> runnable (tcb_state tcb) \<and> (\<exists>tcb. koa = TCB tcb \<and> \<not> halted (tcb_state tcb))) \<and> (\<forall>x21 x22. ys = x21 # x22 \<longrightarrow> x21 \<notin> set x22 \<and> distinct x22 \<and> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr \<and> runnable (tcb_state tcb) \<and> (\<exists>tcb. koa = TCB tcb \<and> \<not> halted (tcb_state tcb))) proof (prove)
goal (1 subgoal):
 1. \<And>y ys s tcb tcba t payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; kheap s y = Some (TCB t); y \<notin> set ys; distinct ys; idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> (ys = [] \<longrightarrow> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr) \<and> (\<forall>x21 x22. ys = x21 # x22 \<longrightarrow> x21 \<notin> set x22 \<and> distinct x22 \<and> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr) proof (prove)
goal (3 subgoals):
 1. \<And>y ys s tcb tcba t payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; kheap s y = Some (TCB t); y \<notin> set ys; distinct ys; idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba); tcb_state t = BlockedOnReceive epptr payload; ys = []\<rbrakk> \<Longrightarrow> thread \<noteq> y
 2. \<And>y ys s tcb tcba t payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; kheap s y = Some (TCB t); y \<notin> set ys; distinct ys; idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba); tcb_state t = BlockedOnReceive epptr payload; ys = []\<rbrakk> \<Longrightarrow> y \<noteq> idle_thread_ptr
 3. \<And>y ys s tcb tcba t payload. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # ys))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # ys))) = kheap s p' \<longrightarrow> epptr = p'; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); \<forall>t\<in>set ys. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; kheap s y = Some (TCB t); y \<notin> set ys; distinct ys; idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba); tcb_state t = BlockedOnReceive epptr payload\<rbrakk> \<Longrightarrow> \<forall>x21 x22. ys = x21 # x22 \<longrightarrow> x21 \<notin> set x22 \<and> distinct x22 \<and> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr proof (prove)
goal (1 subgoal):
 1. \<And>y s tcb tcba t payload x21 x22 ko. \<lbrakk>ep_id = epptr; tcb_id_sender = thread; thread \<noteq> idle_thread_ptr; cur_thread s \<noteq> idle_thread_ptr; valid_etcbs s; kheap s epptr = Some (kernel_object.Endpoint (RecvEP (y # x21 # x22))); none_is_sending_ep epptr s; \<forall>p'. Some (kernel_object.Endpoint (RecvEP (y # x21 # x22))) = kheap s p' \<longrightarrow> epptr = p'; kheap s thread = Some (TCB tcb); pspace_aligned s; active (tcb_state tcb); pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); valid_mdb s; valid_ioc s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; idle_thread s = idle_thread_ptr; kheap s idle_thread_ptr = Some (TCB tcba); kheap s y = Some (TCB t); idle (tcb_state tcba); tcb_bound_notification tcba = None; valid_arch_idle (tcb_iarch tcba); tcb_state t = BlockedOnReceive epptr payload; \<forall>t\<in>set x22. \<exists>ko. kheap s t = Some ko \<and> is_tcb ko; y \<noteq> x21; y \<notin> set x22; x21 \<notin> set x22; distinct x22; kheap s x21 = Some ko; is_tcb ko\<rbrakk> \<Longrightarrow> thread \<noteq> y \<and> y \<noteq> idle_thread_ptr proof (prove)
goal:
No subgoals!