theory Ipc_R

lemma ri_invs' [wp]:
  "\<lbrace>invs' and sch_act_not t
          and ct_in_state' simple'
          and st_tcb_at' simple' t
          and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p))
          and ex_nonz_cap_to' t
          and (\<lambda>s. \<forall>r \<in> zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrace>
  receiveIPC t cap isBlocking
  \<lbrace>\<lambda>_. invs'\<rbrace>" (is "\<lbrace>?pre\<rbrace> _ \<lbrace>_\<rbrace>") apply (clarsimp simp: receiveIPC_def) apply (rule hoare_seq_ext [OF _ get_ep_sp']) apply (rule hoare_seq_ext [OF _ gbn_sp']) apply (rule hoare_seq_ext) 
  (* set up precondition for old proof *)
    apply (rule_tac R="ko_at' ep (capEPPtr cap) and ?pre" in hoare_vcg_if_split) apply (wp completeSignal_invs) apply (case_tac ep)
     \<comment> \<open>endpoint = RecvEP\<close> apply (simp add: invs'_def valid_state'_def) apply (rule hoare_pre, wpc, wp valid_irq_node_lift) apply (simp add: valid_ep'_def) apply (wp sts_sch_act' hoare_vcg_const_Ball_lift valid_irq_node_lift
                sts_valid_queues setThreadState_ct_not_inQ
                asUser_urz
           | simp add: doNBRecvFailedTransfer_def cteCaps_of_def)+ apply (clarsimp simp: valid_tcb_state'_def pred_tcb_at' o_def) apply (rule conjI, clarsimp elim!: obj_at'_weakenE) apply (frule obj_at_valid_objs') apply (clarsimp simp: valid_pspace'_def) apply (drule(1) sym_refs_ko_atD') apply (drule simple_st_tcb_at_state_refs_ofD') apply (drule bound_tcb_at_state_refs_ofD') apply (clarsimp simp: st_tcb_at_refs_of_rev' valid_ep'_def
                           valid_obj'_def projectKOs tcb_bound_refs'_def
                    dest!: isCapDs) apply (rule conjI, clarsimp) apply (drule (1) bspec) apply (clarsimp dest!: st_tcb_at_state_refs_ofD') apply (clarsimp simp: set_eq_subset) apply (rule conjI, erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (rename_tac list one two three fur five six seven eight nine ten eleven) apply (subgoal_tac "set list \<times> {EPRecv} \<noteq> {}") apply (thin_tac "\<forall>a b. t \<notin> set (ksReadyQueues one (a, b))") \<comment> \<open>causes slowdown\<close> apply (safe ; solves \<open>auto\<close>) apply fastforce apply fastforce apply (clarsimp split: if_split_asm) apply (fastforce simp: valid_pspace'_def global'_no_ex_cap idle'_not_queued)
   \<comment> \<open>endpoint = IdleEP\<close> apply (simp add: invs'_def valid_state'_def) apply (rule hoare_pre, wpc, wp valid_irq_node_lift) apply (simp add: valid_ep'_def) apply (wp sts_sch_act' valid_irq_node_lift
               sts_valid_queues setThreadState_ct_not_inQ
               asUser_urz
          | simp add: doNBRecvFailedTransfer_def cteCaps_of_def)+ apply (clarsimp simp: pred_tcb_at' valid_tcb_state'_def o_def) apply (rule conjI, clarsimp elim!: obj_at'_weakenE) apply (subgoal_tac "t \<noteq> capEPPtr cap") apply (drule simple_st_tcb_at_state_refs_ofD') apply (drule ko_at_state_refs_ofD') apply (drule bound_tcb_at_state_refs_ofD') apply (clarsimp dest!: isCapDs) apply (rule conjI, erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (clarsimp simp: tcb_bound_refs'_def
                      dest: symreftype_inverse'
                     split: if_split_asm) apply (fastforce simp: global'_no_ex_cap) apply (clarsimp simp: obj_at'_def pred_tcb_at'_def projectKOs)
   \<comment> \<open>endpoint = SendEP\<close> apply (simp add: invs'_def valid_state'_def) apply (rename_tac list) apply (case_tac list, simp_all split del: if_split) apply (rename_tac sender queue) apply (rule hoare_pre) apply (wp valid_irq_node_lift hoare_drop_imps setEndpoint_valid_mdb'
              set_ep_valid_objs' sts_st_tcb' sts_sch_act' sts_valid_queues
              setThreadState_ct_not_inQ possibleSwitchTo_valid_queues
              possibleSwitchTo_valid_queues'
              possibleSwitchTo_ct_not_inQ hoare_vcg_all_lift
              setEndpoint_ksQ setEndpoint_ct'
         | simp add: valid_tcb_state'_def case_bool_If
                     case_option_If
              split del: if_split cong: if_cong
        | wp (once) sch_act_sane_lift hoare_vcg_conj_lift hoare_vcg_all_lift
                  untyped_ranges_zero_lift)+ apply (clarsimp split del: if_split simp: pred_tcb_at') apply (frule obj_at_valid_objs') apply (clarsimp simp: valid_pspace'_def) apply (frule(1) ct_not_in_epQueue, clarsimp, clarsimp) apply (drule(1) sym_refs_ko_atD') apply (drule simple_st_tcb_at_state_refs_ofD') apply (clarsimp simp: projectKOs valid_obj'_def valid_ep'_def
                         st_tcb_at_refs_of_rev' conj_ac
              split del: if_split
                   cong: if_cong) apply (frule_tac t=sender in valid_queues_not_runnable'_not_ksQ) apply (erule pred_tcb'_weakenE, clarsimp) apply (subgoal_tac "sch_act_not sender s") prefer 2 apply (clarsimp simp: pred_tcb_at'_def obj_at'_def) apply (drule st_tcb_at_state_refs_ofD') apply (simp only: conj_ac(1, 2)[where Q="sym_refs R" for R]) apply (subgoal_tac "distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)") apply (rule conjI) apply (clarsimp simp: ep_redux_simps' cong: if_cong) apply (erule delta_sym_refs) apply (clarsimp split: if_split_asm) apply (fastforce simp: tcb_bound_refs'_def
                      dest: symreftype_inverse'
                     split: if_split_asm) apply (clarsimp simp: singleton_tuple_cartesian split: list.split
            | rule conjI | drule(1) bspec
            | drule st_tcb_at_state_refs_ofD' bound_tcb_at_state_refs_ofD'
            | clarsimp elim!: if_live_state_refsE)+ apply (case_tac cap, simp_all add: isEndpointCap_def) apply (clarsimp simp: global'_no_ex_cap) apply (rule conjI
           | clarsimp simp: singleton_tuple_cartesian split: list.split
           | clarsimp elim!: if_live_state_refsE
           | clarsimp simp: global'_no_ex_cap idle'_not_queued' idle'_no_refs tcb_bound_refs'_def
           | drule(1) bspec | drule st_tcb_at_state_refs_ofD'
           | clarsimp simp: set_eq_subset dest!: bound_tcb_at_state_refs_ofD' )+ apply (rule hoare_pre) apply (wp getNotification_wp | wpc | clarsimp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrace> receiveIPC t cap isBlocking \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. isEndpointCap cap \<Longrightarrow> \<lbrace>invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrace> do ep <- getEndpoint (capEPPtr cap);
ntfnPtr <- getBoundNotification t;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) t else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep. isEndpointCap cap \<Longrightarrow> \<lbrace>invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap)\<rbrace> do ntfnPtr <- getBoundNotification t;
ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) t else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> do ntfn <- case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2;
if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) t else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od
od \<lbrace>\<lambda>_. invs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn. isEndpointCap cap \<Longrightarrow> \<lbrace>?B29 ep ntfnPtr ntfn\<rbrace> if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) t else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?B29 ep ntfnPtr\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn. isEndpointCap cap \<Longrightarrow> \<lbrace>?B29 ep ntfnPtr ntfn\<rbrace> if (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn then completeSignal (the ntfnPtr) t else case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>?B29 ep ntfnPtr\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; (\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn\<rbrakk> \<Longrightarrow> \<lbrace>?Q32 ep ntfnPtr ntfn\<rbrace> completeSignal (the ntfnPtr) t \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn)\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> ?Q32 ep ntfnPtr ntfn s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn)\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ x1 @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; isBlocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?P'136 ep ntfnPtr ntfn x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t \<lbrace>\<lambda>rv s. valid_ep' (Structures_H.endpoint.RecvEP $ x1 @ [t]) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs ((state_refs_of' s)(capEPPtr cap := ep_q_refs_of' (Structures_H.endpoint.RecvEP $ x1 @ [t]))) \<and> (if_live_then_nonz_cap' s \<and> ((Structures_H.endpoint.RecvEP $ x1 @ [t]) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s)) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; isBlocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep ntfnPtr ntfn x1\<rbrace> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; (ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s\<rbrakk> \<Longrightarrow> (isBlocking = True \<longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) s \<and> ?P'136 ep ntfnPtr ntfn x1 s) \<and> (isBlocking = False \<longrightarrow> ?R44 ep ntfnPtr ntfn x1 s)
 4. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'136 (Structures_H.endpoint.RecvEP x1) ntfnPtr ntfn x1\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t \<lbrace>\<lambda>rv s. tcb_at' t s \<and> (\<forall>t\<in>set x1. tcb_at' t s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else state_refs_of' s a) \<and> if_live_then_nonz_cap' s \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>ep ntfnPtr ntfn x1. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; isBlocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R44 ep ntfnPtr ntfn x1\<rbrace> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; (ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s\<rbrakk> \<Longrightarrow> (isBlocking = True \<longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) s \<and> ?P'136 ep ntfnPtr ntfn x1 s) \<and> (isBlocking = False \<longrightarrow> ?R44 ep ntfnPtr ntfn x1 s)
 4. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ep ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.RecvEP x1; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s \<and> valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero_inv (map_option cteCap \<circ> ctes_of s) (gsUntypedZeroRanges s) \<and> cur_tcb' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrakk> \<Longrightarrow> (isBlocking \<longrightarrow> tcb_at' t s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> tcb_at' t s \<and> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> untyped_ranges_zero_inv (\<lambda>a. map_option cteCap (ctes_of s a)) (gsUntypedZeroRanges s)) \<and> (\<not> isBlocking \<longrightarrow> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> untyped_ranges_zero_inv (\<lambda>a. map_option cteCap (ctes_of s a)) (gsUntypedZeroRanges s))
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> ep_at' (capEPPtr cap) s \<and> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; \<exists>k. k = Structures_H.endpoint.RecvEP x1 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 3. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.RecvEP x1) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; \<exists>k. k = Structures_H.endpoint.RecvEP x1 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; \<exists>k. k = Structures_H.endpoint.RecvEP x1 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; \<exists>k. k = Structures_H.endpoint.RecvEP x1 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s); bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; \<exists>k. k = Structures_H.endpoint.RecvEP x1 \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.RecvEP x1)). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x1. tcb_at' x s) \<and> distinct x1 \<and> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<notin> set x1 \<and> sym_refs (\<lambda>a. if a = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<in> set x1\<rbrakk> \<Longrightarrow> False
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<in> set x1; st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) t s\<rbrakk> \<Longrightarrow> False
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr ntfnptra. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; insert (ptr, TCBBlockedRecv) (tcb_bound_refs' ntfnptra) = set_option ntfnptr \<times> {TCBBound}; t \<in> set x1; obj_at' (tcb_ntfn_is_bound' ntfnptra) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> False
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 3. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 4. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>y \<in> set x1 \<longrightarrow> tp \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; y = t \<and> tp = EPRecv \<or> y \<in> set x1 \<and> tp = EPRecv\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> (t = ptr \<longrightarrow> symreftype tp = EPRecv \<or> ptr \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (t \<noteq> ptr \<longrightarrow> symreftype tp = TCBBlockedRecv \<or> ntfnptr = Some ptr \<and> symreftype tp = TCBBound)) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> ptr = t \<and> symreftype tp = EPRecv \<or> ptr \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (ptr, symreftype tp) \<in> state_refs_of' s y))
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 4. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 5. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 7. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; \<forall>a b. t \<notin> set (ksReadyQueues one (a, b)); ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv\<rbrakk> \<Longrightarrow> (ten = t \<longrightarrow> (t = three \<longrightarrow> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (t \<noteq> three \<longrightarrow> symreftype eleven = TCBBlockedRecv \<or> fur = Some three \<and> symreftype eleven = TCBBound)) \<and> (ten \<noteq> t \<longrightarrow> (ten = three \<longrightarrow> three = t \<and> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (ten \<noteq> three \<longrightarrow> (three, symreftype eleven) \<in> state_refs_of' one ten))
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 4. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 5. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 7. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; \<forall>a b. t \<notin> set (ksReadyQueues one (a, b)); ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv; set list \<times> {EPRecv} \<noteq> {}\<rbrakk> \<Longrightarrow> (ten = t \<longrightarrow> (t = three \<longrightarrow> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (t \<noteq> three \<longrightarrow> symreftype eleven = TCBBlockedRecv \<or> fur = Some three \<and> symreftype eleven = TCBBound)) \<and> (ten \<noteq> t \<longrightarrow> (ten = three \<longrightarrow> three = t \<and> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (ten \<noteq> three \<longrightarrow> (three, symreftype eleven) \<in> state_refs_of' one ten))
 2. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; \<forall>a b. t \<notin> set (ksReadyQueues one (a, b)); ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv\<rbrakk> \<Longrightarrow> set list \<times> {EPRecv} \<noteq> {}
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 4. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 5. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 6. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 7. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 8. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv; set list \<times> {EPRecv} \<noteq> {}\<rbrakk> \<Longrightarrow> (ten = t \<longrightarrow> (t = three \<longrightarrow> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (t \<noteq> three \<longrightarrow> symreftype eleven = TCBBlockedRecv \<or> fur = Some three \<and> symreftype eleven = TCBBound)) \<and> (ten \<noteq> t \<longrightarrow> (ten = three \<longrightarrow> three = t \<and> symreftype eleven = EPRecv \<or> three \<in> set list \<and> symreftype eleven = EPRecv) \<and> (ten \<noteq> three \<longrightarrow> (three, symreftype eleven) \<in> state_refs_of' one ten))
 2. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; \<forall>a b. t \<notin> set (ksReadyQueues one (a, b)); ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv\<rbrakk> \<Longrightarrow> set list \<times> {EPRecv} \<noteq> {}
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 4. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 5. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 6. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 7. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 8. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn list one two three fur five six seven eight nine ten eleven. \<lbrakk>ten \<in> set list \<longrightarrow> eleven \<noteq> EPRecv; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' one; sch_act_wf (ksSchedulerAction one) one; Invariants_H.valid_queues one; if_live_then_nonz_cap' one; if_unsafe_then_cap' one; valid_idle' one; valid_global_refs' one; valid_arch_state' one; valid_irq_node' (irq_node' one) one; valid_irq_handlers' one; valid_irq_states' one; valid_machine_state' one; irqs_masked' one; valid_queues' one; ct_not_inQ one; ct_idle_or_in_cur_domain' one; valid_pde_mappings' one; pspace_domain_valid one; ksCurDomain one \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule one = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx one < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of one x)) (gsUntypedZeroRanges one); cur_tcb' one; sch_act_not t one; ct_in_state' simple' one; \<forall>a b. t \<notin> set (ksReadyQueues one (a, b)); ex_nonz_cap_to' t one; ex_nonz_cap_to' three one; isBlocking; cap = capability.EndpointCap three five six seven eight nine; list \<noteq> []; state_refs_of' one three = set list \<times> {EPRecv}; \<forall>x\<in>set list. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive three a) x one; set_option fur \<times> {TCBBound} = tcb_st_refs_of' two \<union> set_option fur \<times> {TCBBound}; \<forall>t\<in>set list. tcb_at' t one; distinct list; obj_at' (tcb_ntfn_is_bound' fur) t one; state_refs_of' one t = set_option fur \<times> {TCBBound}; ten = t \<and> eleven = EPRecv \<or> ten \<in> set list \<and> eleven = EPRecv\<rbrakk> \<Longrightarrow> set list \<times> {EPRecv} \<noteq> {}
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 4. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 5. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 7. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr y tp. \<lbrakk>ntfnptr = Some y \<longrightarrow> tp \<noteq> TCBBound; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; t \<noteq> ptr; y = ptr \<and> tp = TCBBlockedRecv \<or> ntfnptr = Some y \<and> tp = TCBBound\<rbrakk> \<Longrightarrow> (y = t \<longrightarrow> ntfnptr = Some t \<and> symreftype tp = TCBBound) \<and> (y \<noteq> t \<longrightarrow> (y = ptr \<longrightarrow> symreftype tp = EPRecv \<or> t \<in> set x1 \<and> symreftype tp = EPRecv) \<and> (y \<noteq> ptr \<longrightarrow> (t, symreftype tp) \<in> state_refs_of' s y))
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 3. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 4. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then insert (t, EPRecv) (set x1 \<times> {EPRecv}) else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> set_option ntfnptr \<times> {TCBBound}. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 3. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn x1 s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; cap = capability.EndpointCap ptr bdg cans canr cang cangr; x1 \<noteq> []; state_refs_of' s ptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive ptr a) x s; set_option ntfnptr \<times> {TCBBound} = tcb_st_refs_of' ts \<union> set_option ntfnptr \<times> {TCBBound}; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = set_option ntfnptr \<times> {TCBBound}\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; isBlocking = True\<rbrakk> \<Longrightarrow> \<lbrace>?P'1506 ep ntfnPtr ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t \<lbrace>\<lambda>rv s. valid_ep' (Structures_H.endpoint.RecvEP [t]) s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs ((state_refs_of' s)(capEPPtr cap := ep_q_refs_of' (Structures_H.endpoint.RecvEP [t]))) \<and> (if_live_then_nonz_cap' s \<and> (Structures_H.endpoint.RecvEP [t] \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s)) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; isBlocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R1414 ep ntfnPtr ntfn\<rbrace> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 3. \<And>ep ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; (ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s\<rbrakk> \<Longrightarrow> (isBlocking = True \<longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) s \<and> ?P'1506 ep ntfnPtr ntfn s) \<and> (isBlocking = False \<longrightarrow> ?R1414 ep ntfnPtr ntfn s)
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; isBlocking\<rbrakk> \<Longrightarrow> \<lbrace>?P'1506 Structures_H.endpoint.IdleEP ntfnPtr ntfn\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t \<lbrace>\<lambda>rv s. tcb_at' t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else state_refs_of' s a) \<and> if_live_then_nonz_cap' s \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s\<rbrace>
 2. \<And>ep ntfnPtr ntfn. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; isBlocking = False\<rbrakk> \<Longrightarrow> \<lbrace>?R1414 ep ntfnPtr ntfn\<rbrace> doNBRecvFailedTransfer t \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 3. \<And>ep ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; (ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s\<rbrakk> \<Longrightarrow> (isBlocking = True \<longrightarrow> (valid_pspace' and tcb_at' t and valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap))) s \<and> ?P'1506 ep ntfnPtr ntfn s) \<and> (isBlocking = False \<longrightarrow> ?R1414 ep ntfnPtr ntfn s)
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.IdleEP; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s \<and> valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero_inv (map_option cteCap \<circ> ctes_of s) (gsUntypedZeroRanges s) \<and> cur_tcb' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrakk> \<Longrightarrow> (isBlocking \<longrightarrow> tcb_at' t s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) s \<and> tcb_at' t s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> untyped_ranges_zero_inv (\<lambda>a. map_option cteCap (ctes_of s a)) (gsUntypedZeroRanges s)) \<and> (\<not> isBlocking \<longrightarrow> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> untyped_ranges_zero_inv (\<lambda>a. map_option cteCap (ctes_of s a)) (gsUntypedZeroRanges s))
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> ep_at' (capEPPtr cap) s \<and> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; t \<noteq> capEPPtr cap\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; t \<noteq> capEPPtr cap; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; t \<noteq> capEPPtr cap; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS Structures_H.endpoint.IdleEP)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking; t \<noteq> capEPPtr cap; state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS Structures_H.endpoint.IdleEP); \<exists>ts ntfnptr. tcb_bound_refs' ntfnptr = state_refs_of' s t \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = capEPPtr cap then {(t, EPRecv)} else if a = t then insert (capEPPtr cap, TCBBlockedRecv) {r \<in> state_refs_of' s t. snd r = TCBBound} else state_refs_of' s a) \<and> ex_nonz_cap_to' (capEPPtr cap) s \<and> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = ptr then {(t, EPRecv)} else if a = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s a) \<and> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> (if x = ptr then {(t, EPRecv)} else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = ptr then {(t, EPRecv)} else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then {(t, EPRecv)} else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then {(t, EPRecv)} else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 3. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 4. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 5. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 6. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr x y tp. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = ptr then {(t, EPRecv)} else if x = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = ptr then {(t, EPRecv)} else if y = t then insert (ptr, TCBBlockedRecv) {r \<in> tcb_bound_refs' ntfnptr. snd r = TCBBound} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 3. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 4. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s ts ptr ntfnptr bdg cans canr cang cangr. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' ptr s; isBlocking; t \<noteq> ptr; state_refs_of' s ptr = {}; cap = capability.EndpointCap ptr bdg cans canr cang cangr; tcb_bound_refs' ntfnptr = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 2. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 3. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' Structures_H.endpoint.IdleEP (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero_inv (\<lambda>x. map_option cteCap (ctes_of s x)) (gsUntypedZeroRanges s); cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; isBlocking\<rbrakk> \<Longrightarrow> t \<noteq> capEPPtr cap
 2. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; \<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn); ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case ep of Structures_H.endpoint.RecvEP queue \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP $ queue @ [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.IdleEP \<Rightarrow> case isBlocking of True \<Rightarrow> do setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr cap) (capEPCanGrant cap)) t;
setEndpoint (capEPPtr cap) $ Structures_H.endpoint.RecvEP [t]
od | False \<Rightarrow> doNBRecvFailedTransfer t | Structures_H.endpoint.SendEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.SendEP (sender # queue) \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
call <- return (blockingIPCIsCall senderState);
case call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. invs'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn x3. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' (Structures_H.endpoint.SendEP x3) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case x3 of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn list. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' (Structures_H.endpoint.SendEP list) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> case list of [] \<Rightarrow> haskell_fail [] | sender # queue \<Rightarrow> do setEndpoint (capEPPtr cap) $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue;
senderState <- getThreadState sender;
haskell_assert (isSend senderState) [];
badge <- return (blockingIPCBadge senderState);
canGrant <- return (blockingIPCCanGrant senderState);
canGrantReply <- return (blockingIPCCanGrantReply senderState);
doIPCTransfer sender (Just (capEPPtr cap)) badge canGrant t;
return (blockingIPCIsCall senderState) >>= case_bool (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender) (do setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od)
od \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> (invs' and tcb_at' t) s) \<and> (\<not> ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn) \<longrightarrow> (ko_at' ep (capEPPtr cap) and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>p. t \<notin> set (ksReadyQueues s p)) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn list a lista. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP (a # lista); list = a # lista\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' (Structures_H.endpoint.SendEP (a # lista)) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> do y <- setEndpoint (capEPPtr cap) (case lista of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP lista);
senderState <- getThreadState a;
y <- assert (isSend senderState);
y <- doIPCTransfer a (Some (capEPPtr cap)) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) t;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap a t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive a | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running a;
possibleSwitchTo a
od
od \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn list sender queue. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP (sender # queue); list = sender # queue\<rbrakk> \<Longrightarrow> \<lbrace>ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> do y <- setEndpoint (capEPPtr cap) (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue);
senderState <- getThreadState sender;
y <- assert (isSend senderState);
y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) t;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ep ntfnPtr ntfn list sender queue. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP (sender # queue); list = sender # queue\<rbrakk> \<Longrightarrow> \<lbrace>?Q2032 ep ntfnPtr ntfn list sender queue\<rbrace> do y <- setEndpoint (capEPPtr cap) (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue);
senderState <- getThreadState sender;
y <- assert (isSend senderState);
y <- doIPCTransfer sender (Some (capEPPtr cap)) (blockingIPCBadge senderState) (blockingIPCCanGrant senderState) t;
case blockingIPCIsCall senderState of True \<Rightarrow> case blockingIPCCanGrant senderState \<or> blockingIPCCanGrantReply senderState of True \<Rightarrow> setupCallerCap sender t (capEPCanGrant cap) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive sender | False \<Rightarrow> do y <- setThreadState Structures_H.thread_state.Running sender;
possibleSwitchTo sender
od
od \<lbrace>\<lambda>_. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace>
 2. \<And>ep ntfnPtr ntfn list sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP (sender # queue); list = sender # queue; (ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) and ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))) s\<rbrakk> \<Longrightarrow> ?Q2032 ep ntfnPtr ntfn list sender queue s
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr ntfn list sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ep = Structures_H.endpoint.SendEP (sender # queue); list = sender # queue; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s \<and> valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> tcb_at' t s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> tcb_at' t s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; \<exists>k. k = Structures_H.endpoint.SendEP (sender # queue) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; \<exists>k. k = Structures_H.endpoint.SendEP (sender # queue) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s)\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; ko_at' (Structures_H.endpoint.SendEP (sender # queue)) (capEPPtr cap) s; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; \<exists>k. k = Structures_H.endpoint.SendEP (sender # queue) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); ksCurThread s \<notin> set (epQueue (Structures_H.endpoint.SendEP (sender # queue)))\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; st_tcb_at' simple' t s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; \<exists>k. k = Structures_H.endpoint.SendEP (sender # queue) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); ksCurThread s \<notin> set (epQueue (Structures_H.endpoint.SendEP (sender # queue))); state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.SendEP (sender # queue))) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP (sender # queue))). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; \<exists>k. k = Structures_H.endpoint.SendEP (sender # queue) \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKOS k = ko) \<longrightarrow> valid_obj' (injectKOS k) s); ksCurThread s \<notin> set (epQueue (Structures_H.endpoint.SendEP (sender # queue))); state_refs_of' s (capEPPtr cap) = refs_of' (injectKOS (Structures_H.endpoint.SendEP (sender # queue))) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP (sender # queue))). ko_wp_at' (\<lambda>ko. (capEPPtr cap, symreftype tp) \<in> refs_of' ko) x s); bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s\<rbrakk> \<Longrightarrow> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> sch_act_not sender s \<and> (\<forall>x xa. sender \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> tcb_at' sender s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> sym_refs (\<lambda>a. if a = sender then {r \<in> if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender. snd r = TCBBound} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> ex_nonz_cap_to' sender s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> sender \<noteq> ksIdleThread s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_objs' s \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s \<and> valid_mdb' s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> ksCurThread s \<noteq> sender \<and> valid_ep' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) s
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s\<rbrakk> \<Longrightarrow> st_tcb_at' (Not \<circ> runnable') sender s
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> sch_act_not sender s
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> sch_act_not sender s
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) sender s; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> sch_act_not sender s \<and> (\<forall>a b. sender \<notin> set (ksReadyQueues s (a, b))) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts) \<and> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> r \<in> (if sender = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s sender)} else if a = capEPPtr cap then ep_q_refs_of' (case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) else state_refs_of' s a)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; ksIdleThread s \<noteq> capEPPtr cap; ksIdleThread s \<noteq> t; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s \<noteq> sender; ksIdleThread s \<notin> set queue; capEPPtr cap \<noteq> t; capEPPtr cap \<noteq> sender; capEPPtr cap \<notin> set queue; t \<noteq> sender; t \<notin> set queue\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if a = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s a)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr x y tp. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; ksIdleThread s \<noteq> capEPPtr cap; ksIdleThread s \<noteq> t; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s \<noteq> sender; ksIdleThread s \<notin> set queue; capEPPtr cap \<noteq> t; capEPPtr cap \<noteq> sender; capEPPtr cap \<notin> set queue; t \<noteq> sender; t \<notin> set queue; (y, tp) \<in> (if x = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if x = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if y = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn sender queue s ntfnptr x y tp. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; ksIdleThread s \<noteq> capEPPtr cap; ksIdleThread s \<noteq> t; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s \<noteq> sender; ksIdleThread s \<notin> set queue; capEPPtr cap \<noteq> t; capEPPtr cap \<noteq> sender; capEPPtr cap \<notin> set queue; t \<noteq> sender; t \<notin> set queue; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if x = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if y = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s y)
 3. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 4. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 5. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr x y tp. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; ksIdleThread s \<noteq> capEPPtr cap; ksIdleThread s \<noteq> t; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s \<noteq> sender; ksIdleThread s \<notin> set queue; capEPPtr cap \<noteq> t; capEPPtr cap \<noteq> sender; capEPPtr cap \<notin> set queue; t \<noteq> sender; t \<notin> set queue; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if x = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = sender then {r. snd r = TCBBound \<and> (r = (capEPPtr cap, TCBBlockedSend) \<or> r \<in> tcb_bound_refs' ntfnptr)} else if y = capEPPtr cap then set queue \<times> {EPSend} else state_refs_of' s y)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 3. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 4. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_mdb' s \<and> valid_objs' s \<and> ex_nonz_cap_to' sender s \<and> sender \<noteq> ksIdleThread s \<and> t \<noteq> ksIdleThread s \<and> \<not> False \<and> (\<forall>a b. \<not> False) \<and> ((case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue) \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ex_nonz_cap_to' (capEPPtr cap) s) \<and> (case case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP queue of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts)
 2. \<And>ntfnPtr ntfn sender queue s. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; \<exists>ts ntfnptr. (\<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s \<and> state_refs_of' s sender = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> distinct (ksIdleThread s # capEPPtr cap # t # sender # queue)
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr ts ntfnptra. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s = capEPPtr cap; tcb_bound_refs' ntfnptra = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptra; obj_at' (tcb_ntfn_is_bound' ntfnptra) t s; state_refs_of' s t = tcb_bound_refs' ntfnptra\<rbrakk> \<Longrightarrow> False
 2. \<And>ntfnPtr ntfn sender queue s ntfnptr. \<lbrakk>isEndpointCap cap; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ksIdleThread s \<noteq> t \<and> ksIdleThread s \<noteq> sender \<and> ksIdleThread s \<notin> set queue \<and> capEPPtr cap \<noteq> t \<and> capEPPtr cap \<noteq> sender \<and> capEPPtr cap \<notin> set queue \<and> t \<noteq> sender \<and> t \<notin> set queue
 3. \<And>ep ntfnPtr. isEndpointCap cap \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr ts ntfnptra x51 x52 x53 x54 x55 x56. \<lbrakk>ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; ex_nonz_cap_to' x51 s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s x51 = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend x51 a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (x51, TCBBlockedSend) (tcb_bound_refs' ntfnptr); ksIdleThread s = x51; tcb_bound_refs' ntfnptra = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptra; obj_at' (tcb_ntfn_is_bound' ntfnptra) t s; state_refs_of' s t = tcb_bound_refs' ntfnptra; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> False
 2. \<And>ntfnPtr ntfn sender queue s ntfnptr. \<lbrakk>case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ksIdleThread s \<noteq> t \<and> ksIdleThread s \<noteq> sender \<and> ksIdleThread s \<notin> set queue \<and> capEPPtr cap \<noteq> t \<and> capEPPtr cap \<noteq> sender \<and> capEPPtr cap \<notin> set queue \<and> t \<noteq> sender \<and> t \<notin> set queue
 3. \<And>ep ntfnPtr. case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr ntfn sender queue s ntfnptr. \<lbrakk>case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False; ntfnPtr = None \<or> \<not> EndpointDecls_H.isActive ntfn; valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). 0 < dschLength x \<and> dschDomain x \<le> maxDomain; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; sch_act_not t s; ct_in_state' simple' s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ex_nonz_cap_to' t s; \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s t) t s; distinct queue; ksCurThread s \<noteq> sender; ksCurThread s \<notin> set queue; state_refs_of' s (capEPPtr cap) = insert (sender, EPSend) (set queue \<times> {EPSend}); sender \<notin> set queue; \<forall>x\<in>set queue. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend (capEPPtr cap) a b c d) x s; tcb_at' sender s; \<forall>t\<in>set queue. tcb_at' t s; \<forall>d p. sender \<notin> set (ksReadyQueues s (d, p)); sch_act_not sender s; obj_at' (tcb_ntfn_is_bound' ntfnptr) sender s; state_refs_of' s sender = insert (capEPPtr cap, TCBBlockedSend) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> ksIdleThread s \<noteq> t \<and> ksIdleThread s \<noteq> sender \<and> ksIdleThread s \<notin> set queue \<and> capEPPtr cap \<noteq> t \<and> capEPPtr cap \<noteq> sender \<and> capEPPtr cap \<notin> set queue \<and> t \<noteq> sender \<and> t \<notin> set queue
 2. \<And>ep ntfnPtr. case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ep ntfnPtr. case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False \<Longrightarrow> \<lbrace>bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ep ntfnPtr. case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False \<Longrightarrow> \<lbrace>?Q4145 ep ntfnPtr\<rbrace> case ntfnPtr of None \<Rightarrow> return (NTFN Structures_H.ntfn.IdleNtfn None) | Some x2 \<Rightarrow> getNotification x2 \<lbrace>\<lambda>ntfn s. ((\<exists>y. ntfnPtr = Some y) \<and> EndpointDecls_H.isActive ntfn \<longrightarrow> invs' s \<and> tcb_at' t s) \<and> (ntfnPtr = None \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s)) \<and> (\<not> EndpointDecls_H.isActive ntfn \<longrightarrow> ko_at' ep (capEPPtr cap) s \<and> invs' s \<and> sch_act_not t s \<and> ct_in_state' simple' s \<and> st_tcb_at' simple' t s \<and> (\<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) \<and> ex_nonz_cap_to' t s \<and> (\<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s))\<rbrace>
 2. \<And>ep ntfnPtr s. \<lbrakk>case cap of capability.EndpointCap v0 v1 v2 v3 v4 v5 \<Rightarrow> True | _ \<Rightarrow> False; (bound_tcb_at' (\<lambda>st. st = ntfnPtr) t and (invs' and sch_act_not t and ct_in_state' simple' and st_tcb_at' simple' t and (\<lambda>s. \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))) and ex_nonz_cap_to' t and (\<lambda>s. \<forall>r\<in>zobj_refs' cap. ex_nonz_cap_to' r s) and ko_at' ep (capEPPtr cap))) s\<rbrakk> \<Longrightarrow> ?Q4145 ep ntfnPtr s proof (prove)
goal:
No subgoals!